Vulnerabilities exploitable today
355,213in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,656
New KEV · 24H0
Exploit Today ≥ 701,601
Distribution · last window
- Critical2,523
- High9,111
- Medium7,331
- Low692
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-272977.8 HIG6.9%
——2Adobe Framemaker versions 2022.8 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.10dCVE-2026-348136.4 MED6.9%
——2Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the user parameter to /cgi-bin/proxyuser.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.11dCVE-2026-615045.4 MED6.9%
——2Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the ?get=basic parameter. A user with upload permission - or an anonymous user on servers with an open upload folder - can store a file whose name contains script that executes in the browser of anyone viewing the listing.20dCVE-2024-9055—6.9%
——2——CVE-2026-3007—6.9%
——2——CVE-2026-22705—6.9%
——2——CVE-2025-24094—6.9%
——2——CVE-2025-264836.1 MED6.9%
——2Dell PowerFlex Manager, versions 4.6.2 and prior, contains an Open Redirect Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The vulnerability could be leveraged by attackers to conduct phishing attacks that cause users to divulge sensitive information.12dCVE-2026-44247—6.9%
——2——CVE-2022-48435—6.9%
——2——CVE-2024-49864—6.9%
——2——CVE-2023-34043—6.9%
——2——CVE-2024-20888—6.9%
——2——CVE-2023-38069—6.9%
——2——CVE-2024-31854—6.9%
——2——CVE-2025-71069—6.9%
——2——CVE-2024-57964—6.9%
——2——CVE-2026-614653.3 LOW6.9%
——2ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.21dCVE-2025-64198—6.9%
——2——CVE-2024-26781—6.9%
——2——CVE-2023-54242—6.9%
——2——CVE-2025-22246—6.9%
——2——CVE-2023-54259—6.9%
——2——CVE-2024-46733—6.9%
——2——CVE-2024-57963—6.9%
——2——CVE-2024-27003—6.9%
——2——CVE-2023-42433—6.9%
——2——CVE-2026-30985—6.9%
——2——CVE-2023-52645—6.9%
——2——CVE-2022-50871—6.9%
——2——CVE-2026-40243—6.9%
——2——CVE-2025-383958.4 HIG6.9%
——2In the Linux kernel, the following vulnerability has been resolved:
regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
drvdata::gpiods is supposed to hold an array of 'gpio_desc' pointers. But
the memory is allocated for only one pointer. This will lead to
out-of-bounds access later in the code if 'config::ngpios' is > 1. So
fix the code to allocate enough memory to hold 'config::ngpios' of GPIO
descriptors.
While at it, also move the check for memory allocation failure to be below
the allocation to make it more readable.5dCVE-2026-02436.5 MED6.9%
——2A denial of service (DoS) vulnerability in Palo Alto Networks Prisma SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma SD-WAN ION device to cause a system disruption by sending a specially crafted IPv6 packet.21dCVE-2026-272908.6 HIG6.9%
——2Adobe Framemaker versions 2022.8 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue does not require user interaction.10dCVE-2025-62074—6.9%
——2——CVE-2023-42939—6.9%
——2——CVE-2024-26790—6.9%
——2——CVE-2025-383758.4 HIG6.9%
——2In the Linux kernel, the following vulnerability has been resolved:
virtio-net: ensure the received length does not exceed allocated size
In xdp_linearize_page, when reading the following buffers from the ring,
we forget to check the received length with the true allocate size. This
can lead to an out-of-bound read. This commit adds that missing check.5dCVE-2024-31853—6.9%
——2——CVE-2025-69652—6.9%
——2——