Vulnerabilities exploitable today
354,831in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,656
New KEV · 24H0
Exploit Today ≥ 701,601
Distribution · last window
- Critical2,569
- High9,189
- Medium7,427
- Low693
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-56744—5.7%
——2——CVE-2025-1435—5.7%
——2——CVE-2025-68242—5.7%
——2——CVE-2025-26850—5.7%
——2——CVE-2017-17767—5.7%
——2——CVE-2025-68329—5.7%
——2——CVE-2025-23627—5.7%
——2——CVE-2022-27187—5.7%
——2——CVE-2023-30725—5.7%
——2——CVE-2022-50043—5.7%
——2——CVE-2021-1123—5.7%
——2——CVE-2025-0714—5.7%
——2——CVE-2019-25281—5.7%
——2——CVE-2020-36982—5.7%
——2——CVE-2025-29231—5.7%
——2——CVE-2020-36974—5.7%
——2——CVE-2017-14892—5.7%
——2——CVE-2025-38313—5.7%
——2——CVE-2025-57462—5.7%
——2——CVE-2017-17771—5.7%
——2——CVE-2024-58095—5.7%
——2——CVE-2025-43005—5.7%
——2——CVE-2025-23118—5.7%
——2——CVE-2025-3153—5.7%
——2——CVE-2026-64527—5.7%
——2In the Linux kernel, the following vulnerability has been resolved:
drm/hyperv: validate VMBus packet size in receive callback
hyperv_receive_sub() reads msg->vid_hdr.type and dispatches into one
of four message-type branches without knowing how many bytes the host
wrote into hv->recv_buf. The completion path then runs
memcpy(hv->init_buf, msg, VMBUS_MAX_PACKET_SIZE), so the consumer that
wakes on wait_for_completion_timeout() can read up to 16 KiB of
residue from a prior message as if it were the response payload.
Pass bytes_recvd into hyperv_receive_sub() and reject any packet that
does not cover the pipe + synthvid header. A single switch on
msg->vid_hdr.type then computes the type-specific payload size: the
three completion-driving types (SYNTHVID_VERSION_RESPONSE,
SYNTHVID_RESOLUTION_RESPONSE, SYNTHVID_VRAM_LOCATION_ACK) fall through
to a shared exit that requires that size before memcpy/complete, while
SYNTHVID_FEATURE_CHANGE validates its own payload and returns before
reading is_dirt_needed. Unknown types are dropped.
SYNTHVID_RESOLUTION_RESPONSE is variable length: the host fills
resolution_count entries, not the full SYNTHVID_MAX_RESOLUTION_COUNT
array. Validate the fixed prefix first so resolution_count can be
read, bound it against the array, then require only the count-sized
array, so the shorter responses the host actually sends are accepted.
Only run the sub-handler when vmbus_recvpacket() returned success. The
memcpy length is bytes_recvd, which is bounded by VMBUS_MAX_PACKET_SIZE
only on a successful receive; on -ENOBUFS vmbus_recvpacket() instead
reports the required length, which can exceed hv->recv_buf, so copying
bytes_recvd would read and write past the 16 KiB buffers. Gating on the
success return keeps the copy bounded. The nonzero-return path is itself
a malformed-message case and is now logged rather than silently skipped;
channel recovery is not attempted.
Rejected packets are reported via drm_err_ratelimited() rather than
silently dropped, matching the CoCo-hardened pattern in
hv_kvp_onchannelcallback().8dCVE-2025-64769—5.7%
——2——CVE-2025-68311—5.7%
——2——CVE-2026-42095—5.7%
——2——CVE-2023-20515—5.7%
——2——CVE-2026-40944—5.7%
——2——CVE-2025-2236—5.7%
——2——CVE-2023-4162—5.7%
——2——CVE-2025-68240—5.7%
——2——CVE-2020-0259—5.7%
——2——CVE-2025-48921—5.7%
——2——CVE-2025-68298—5.7%
——2——CVE-2018-9560—5.7%
——2——CVE-2025-67443—5.7%
——2——CVE-2022-4149—5.7%
——2——CVE-2025-526093.7 LOW5.7%
——2HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-in XSS filtering mechanisms of modern web browsers.10d