Vulnerabilities exploitable today
355,789in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,660
New KEV · 24H0
Exploit Today ≥ 701,604
Distribution · last window
- Critical2,756
- High11,042
- Medium7,295
- Low703
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-27446—7.3%
——2——CVE-2026-24997—7.3%
——2——CVE-2023-52668—7.3%
——2——CVE-2024-52939—7.3%
——2——CVE-2024-31251—7.3%
——2——CVE-2026-64457—7.3%
——2In the Linux kernel, the following vulnerability has been resolved:
virtio_pci: fix vq info pointer lookup via wrong index
Unbinding a virtio balloon device:
echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind
triggers a NULL pointer dereference. The dmesg says:
BUG: kernel NULL pointer dereference, address: 0000000000000008
[...]
RIP: 0010:__list_del_entry_valid_or_report+0x5/0xf0
Call Trace:
<TASK>
vp_del_vqs+0x121/0x230
remove_common+0x135/0x150
virtballoon_remove+0xee/0x100
virtio_dev_remove+0x3b/0x80
device_release_driver_internal+0x187/0x2c0
unbind_store+0xb9/0xe0
kernfs_fop_write_iter.llvm.11660790530567441834+0xf6/0x180
vfs_write+0x2a9/0x3b0
ksys_write+0x5c/0xd0
do_syscall_64+0x54/0x230
entry_SYSCALL_64_after_hwframe+0x29/0x31
[...]
</TASK>
The virtio_balloon device registers 5 queues (inflate, deflate, stats,
free_page, reporting) but only the first two are unconditional. The
stats, free_page and reporting queues are each conditional on their
respective feature bits. When any of these features are absent, the
corresponding vqs_info entry has name == NULL, creating holes in the
array.
The root cause is an indexing mismatch introduced when vq info storage
was changed to be passed as an argument. vp_find_vqs_msix() and
vp_find_vqs_intx() store the info pointer at vp_dev->vqs[i], where 'i'
is the caller's sparse array index. However, the virtqueue itself gets
vq->index assigned from queue_idx, a dense index that skips NULL
entries. When holes exist, 'i' and queue_idx diverge. Later,
vp_del_vqs() looks up info via vp_dev->vqs[vq->index] using the dense
index into the sparsely-populated array, and hits NULL.
Fix this by storing info at vp_dev->vqs[queue_idx] instead of
vp_dev->vqs[i], so the store index matches the lookup index
(vq->index). Apply the fix to both the MSIX and INTX paths.12dCVE-2025-68522—7.3%
——2——CVE-2023-21496—7.3%
——2——CVE-2025-53357—7.3%
——2——CVE-2022-495317.8 HIG7.3%
——2In the Linux kernel, the following vulnerability has been resolved:
loop: implement ->free_disk
Ensure that the lo_device which is stored in the gendisk private
data is valid until the gendisk is freed. Currently the loop driver
uses a lot of effort to make sure a device is not freed when it is
still in use, but to to fix a potential deadlock this will be relaxed
a bit soon.2dCVE-2025-12729—7.3%
——2——CVE-2016-20092—7.3%
——2——CVE-2024-34164—7.3%
——2——CVE-2022-42831—7.3%
——2——CVE-2025-14744—7.3%
——2——CVE-2026-48927—7.3%
——2——CVE-2024-27358—7.3%
——2——CVE-2025-49382—7.3%
——2——CVE-2024-566247.8 HIG7.3%
——2In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix out_fput in iommufd_fault_alloc()
As fput() calls the file->f_op->release op, where fault obj and ictx are
getting released, there is no need to release these two after fput() one
more time, which would result in imbalanced refcounts:
refcount_t: decrement hit 0; leaking memory.
WARNING: CPU: 48 PID: 2369 at lib/refcount.c:31 refcount_warn_saturate+0x60/0x230
Call trace:
refcount_warn_saturate+0x60/0x230 (P)
refcount_warn_saturate+0x60/0x230 (L)
iommufd_fault_fops_release+0x9c/0xe0 [iommufd]
...
VFS: Close: file count is 0 (f_op=iommufd_fops [iommufd])
WARNING: CPU: 48 PID: 2369 at fs/open.c:1507 filp_flush+0x3c/0xf0
Call trace:
filp_flush+0x3c/0xf0 (P)
filp_flush+0x3c/0xf0 (L)
__arm64_sys_close+0x34/0x98
...
imbalanced put on file reference count
WARNING: CPU: 48 PID: 2369 at fs/file.c:74 __file_ref_put+0x100/0x138
Call trace:
__file_ref_put+0x100/0x138 (P)
__file_ref_put+0x100/0x138 (L)
__fput_sync+0x4c/0xd0
Drop those two lines to fix the warnings above.2dCVE-2024-34807—7.3%
——2——CVE-2024-31407—7.3%
——2——CVE-2022-32490—7.3%
——2——CVE-2026-35571—7.3%
——2——CVE-2022-41659—7.3%
——2——CVE-2024-37024—7.3%
——2——CVE-2024-27010—7.3%
——2——CVE-2026-47994.3 MED7.3%
——2In Search Guard FLX up to version 4.0.1, it is possible to use specially crafted requests to redirect the user to an untrusted URL.12dCVE-2026-44733—7.3%
——2——CVE-2022-33921—7.3%
——2——CVE-2022-37327—7.3%
——2——CVE-2021-22382—7.3%
——2——CVE-2026-13325—7.3%
——2Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.1dCVE-2026-0661—7.3%
——2——CVE-2022-3743—7.2%
——2——CVE-2024-20131—7.3%
——2——CVE-2016-20089—7.3%
——2——CVE-2025-699497.3 HIG7.3%
——2kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email.6dCVE-2023-0186—7.3%
——2——CVE-2023-21440—7.3%
——2——CVE-2024-57877—7.3%
——2——