Vulnerabilities exploitable today
355,789in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,660
New KEV · 24H0
Exploit Today ≥ 701,604
Distribution · last window
- Critical2,756
- High11,042
- Medium7,295
- Low703
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-6227—7.3%
——2——CVE-2023-21496—7.3%
——2——CVE-2024-34028—7.3%
——2——CVE-2025-2223—7.2%
——2——CVE-2025-8851—7.3%
——2——CVE-2025-44779—7.2%
——2——CVE-2021-26397—7.3%
——2——CVE-2025-21047—7.3%
——2——CVE-2026-13325—7.3%
——2Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.1dCVE-2022-3743—7.2%
——2——CVE-2021-22382—7.3%
——2——CVE-2026-0661—7.3%
——2——CVE-2026-279564.3 MED7.3%
——2Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, `GET /api/v1/servers/{server_uuid}/domains?uuid={app_uuid}` bypasses team scoping when the optional uuid query parameter is provided. Any authenticated API user can enumerate domain names (FQDNs) of applications belonging to other teams. This vulnerability is fixed in 4.0.0-beta.464.36dCVE-2022-33921—7.3%
——2——CVE-2022-37327—7.3%
——2——CVE-2024-43088—7.3%
——2——CVE-2024-28950—7.3%
——2——CVE-2026-44733—7.3%
——2——CVE-2026-64127—7.3%
——2In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer
Commit 1c08108f3014 ("Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end
warnings") converted the on-stack request PDU in l2cap_ecred_reconfigure()
from an explicit packed struct to DEFINE_RAW_FLEX(), but did not adjust the
size and source-pointer arguments to l2cap_send_cmd():
- struct {
- struct l2cap_ecred_reconf_req req;
- __le16 scid;
- } pdu;
+ DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1);
...
l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ,
sizeof(pdu), &pdu);
After the conversion, DEFINE_RAW_FLEX() expands to declare an anonymous
union pdu_u plus a local pointer "pdu" pointing at it. Therefore:
- sizeof(pdu) is now sizeof(struct l2cap_ecred_reconf_req *) = 8 on
64-bit (4 on 32-bit), not the 6 bytes of (mtu, mps, scid[1]).
- &pdu is the address of the local pointer's stack storage, not the
address of the request payload.
l2cap_send_cmd() forwards (data, count) to l2cap_build_cmd(), which calls
skb_put_data(skb, data, count). The L2CAP_ECRED_RECONFIGURE_REQ packet
body therefore contains 8 bytes copied from the kernel stack starting at
&pdu -- the 8 bytes overlap the pdu pointer's value, leaking a kernel
stack address to the paired Bluetooth peer. The intended (mtu, mps, scid)
fields are not transmitted at all, so the peer rejects the request as
malformed and the L2CAP_ECRED_RECONFIGURE feature itself has been broken
for the local-side initiator since the introducing commit landed.
The sibling site l2cap_ecred_conn_req() in the same commit was converted
correctly (sizeof(*pdu) + len, pdu); only this site was missed.
Restore the original semantics: pass the full flex-struct size via
struct_size(pdu, scid, 1) and the pdu pointer (the struct address) as
the source.
Validated on a stock 7.0-based host kernel via the real call path:
setsockopt(SOL_BLUETOOTH, BT_RCVMTU, ...) on a BT_CONNECTED
L2CAP_MODE_EXT_FLOWCTL socket emits an L2CAP_ECRED_RECONFIGURE_REQ
whose body is 8 bytes (the on-stack pdu local's value) rather than
the expected 6. Three captures from fresh socket / fresh hciemu peer
on the same host -- low bytes vary per call, high 0xffff confirms a
kernel virtual address (KASLR-randomised stack slot, not a fixed
string):
RECONF_REQ body (ident=0x02 len=8): 42 fb 54 af 0e ca ff ff
RECONF_REQ body (ident=0x02 len=8): 52 3d 2e af 0e ca ff ff
RECONF_REQ body (ident=0x02 len=8): b2 fc 5b af 0e ca ff ff
After this patch the body is 6 bytes carrying the expected
little-endian (mtu, mps, scid).6dCVE-2016-20088—7.3%
——2——CVE-2025-15587—7.3%
——2——CVE-2016-20087—7.3%
——2——CVE-2025-43499—7.3%
——2——CVE-2022-22233—7.3%
——2——CVE-2026-576764.3 MED7.3%
——2Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Simple User Avatar: from n/a through 4.9.28dCVE-2026-140314.3 MED7.3%
——2Inappropriate implementation in File Input in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)35dCVE-2019-25747—7.3%
——2——CVE-2025-0250—7.3%
——2——CVE-2026-13428.5 HIG7.3%
——2IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 could allow a locally authenticated user to execute malicious scripts from outside of its control sphere.12dCVE-2022-42832—7.3%
——2——CVE-2016-20093—7.3%
——2——CVE-2026-33690—7.3%
——2——CVE-2025-1142—7.3%
——2——CVE-2026-150834.2 MED7.3%
——2Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4.23dCVE-2026-48980—7.3%
——2——CVE-2025-13640—7.3%
——2——CVE-2024-54091—7.3%
——2——CVE-2024-25103—7.3%
——2——CVE-2020-37254—7.3%
——2——CVE-2024-38601—7.3%
——2——