Vulnerabilities exploitable today
354,953in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,656
New KEV · 24H0
Exploit Today ≥ 701,601
Distribution · last window
- Critical2,556
- High9,179
- Medium7,436
- Low693
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-43883—6.4%
——2——CVE-2020-0051—6.4%
——2——CVE-2023-27305—6.4%
——2——CVE-2026-25362—6.4%
——2——CVE-2021-23182—6.4%
——2——CVE-2026-3392—6.4%
——2——CVE-2026-351486.3 MED6.4%
——2HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of their identity or authorization level.12dCVE-2024-23976—6.4%
——2——CVE-2023-31271—6.4%
——2——CVE-2025-68249—6.4%
——2——CVE-2025-5791—6.4%
——2——CVE-2026-326075.4 MED6.4%
——2Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, when the hidden prioritize_full_name_in_ux site setting is enabled (defaults to false, requires console access to change), user and group display names are rendered without HTML escaping in several assignment-related UI paths. This allows users with assign permission to inject arbitrary HTML/JavaScript that executes in the browser of any user viewing an affected topic. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.9dCVE-2019-9443—6.3%
——2——CVE-2022-49089—6.3%
——2——CVE-2026-48861—6.3%
——2Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in elixir-mint Mint allows HTTP Request Splitting and HTTP Request Smuggling.
In lib/mint/http1/request.ex, the encode_request_line/2 function splices the caller-supplied method and target arguments directly into the HTTP/1 request line without any character validation: [method, ?\s, target, " HTTP/1.1\r\n"]. An application that forwards attacker-controlled input as the HTTP method or target to Mint.HTTP.request/5 is therefore exposed to request-line CRLF injection: the attacker can terminate the request line early, inject arbitrary headers, and smuggle an entirely separate pipelined HTTP request onto the same TCP connection.
Mint 1.7.0 introduced validate_request_target/2, which rejects CRLF and other control characters in the target by default and closes the path/query vector unless the caller opts out via skip_target_validation: true. The method field remains unvalidated, so the method-based injection is exploitable under the default Mint configuration on all versions.
This issue affects mint: from 0.1.0 before 1.9.0.11dCVE-2026-27234—6.3%
——2——CVE-2022-41646—6.3%
——2——CVE-2026-27235—6.3%
——2——CVE-2025-38699—6.3%
——2——CVE-2025-403317.8 HIG6.3%
——2In the Linux kernel, the following vulnerability has been resolved:
sctp: Prevent TOCTOU out-of-bounds write
For the following path not holding the sock lock,
sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump()
make sure not to exceed bounds in case the address list has grown
between buffer allocation (time-of-check) and write (time-of-use).4dCVE-2026-242687.8 HIG6.3%
——2NVIDIA TensorRT contains a vulnerability where an attacker might cause a heap-based buffer overflow. A successful exploit of this vulnerability might lead to code execution.17dCVE-2022-28214—6.3%
——2——CVE-2025-66444—6.3%
——2——CVE-2023-25496—6.3%
——2——CVE-2025-20255—6.3%
——2——CVE-2026-27232—6.3%
——2——CVE-2026-353905.4 MED6.3%
——2Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the reverse proxy (proxy.ts) set the Content-Security-Policy-Report-Only header instead of the enforcing Content-Security-Policy header. This means cross-site scripting (XSS) attacks were logged but not blocked. Any user who could inject script content (e.g., via crafted email HTML) could execute arbitrary JavaScript in the context of the application, potentially stealing session tokens or performing actions on behalf of the user. This vulnerability is fixed in 1.4.11.9dCVE-2017-15844—6.3%
——2——CVE-2026-27239—6.3%
——2——CVE-2025-48796—6.3%
——2——CVE-2026-27237—6.3%
——2——CVE-2026-319827.1 HIG6.3%
——2An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who subsequently initiate SAML Single Sign-On, enabling phishing and credential-theft attacks, as well as disrupting SAML authentication for all affected users.24dCVE-2026-27250—6.3%
——2——CVE-2022-50223—6.3%
——2——CVE-2026-27244—6.3%
——2——CVE-2022-34377—6.3%
——2——CVE-2022-4457—6.3%
——2——CVE-2026-27233—6.3%
——2——CVE-2026-27252—6.3%
——2——CVE-2025-11696—6.3%
——2——