Vulnerabilities exploitable today
354,825in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,656
New KEV · 24H0
Exploit Today ≥ 701,601
Distribution · last window
- Critical2,579
- High9,216
- Medium7,452
- Low693
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-13936—5.6%
——2——CVE-2026-45899—5.6%
——2——CVE-2022-50104—5.6%
——2——CVE-2022-50126—5.6%
——2——CVE-2022-50029—5.6%
——2——CVE-2025-38043—5.6%
——2——CVE-2026-397065.3 MED5.6%
——2Missing Authorization vulnerability in Netro Systems Make My Trivia trivialy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Make My Trivia: from n/a through <= 1.1.0.8dCVE-2025-38040—5.6%
——2——CVE-2022-50141—5.6%
——2——CVE-2025-58486—5.6%
——2——CVE-2021-37643—5.6%
——2——CVE-2026-643187.1 HIG5.6%
——2In the Linux kernel, the following vulnerability has been resolved:
partitions: aix: bound the pp_count scan to the ppe array
aix_partition() reads the physical volume descriptor into a fixed-size
struct pvd and then scans its physical-partition-extent array:
int numpps = be16_to_cpu(pvd->pp_count);
...
for (i = 0; i < numpps; i += 1) {
struct ppe *p = pvd->ppe + i;
...
lp_ix = be16_to_cpu(p->lp_ix);
pvd points at a single kmalloc()'d struct pvd whose ppe[] member holds a
fixed ARRAY_SIZE(pvd->ppe) (1016) entries, but the loop runs up to the
on-disk pp_count. pp_count is an unvalidated __be16 read straight from
the descriptor, so a crafted AIX image with pp_count larger than 1016
drives the loop to read pvd->ppe[i] past the end of the allocation (up
to 65535 entries, ~2 MB out of bounds).
The partition scan runs without mounting anything, when a block device
with a crafted AIX/IBM partition table appears (an attacker-supplied
image attached with losetup -P, or a device auto-scanned by udev), via
msdos_partition() -> aix_partition().
Clamp the scan to the number of entries the ppe[] array can hold.6dCVE-2025-14409—5.6%
——2——CVE-2021-37637—5.6%
——2——CVE-2018-9388—5.6%
——2——CVE-2024-38668—5.6%
——2——CVE-2024-43428—5.6%
——2——CVE-2025-38277—5.6%
——2——CVE-2025-59406—5.6%
——2——CVE-2026-630974.3 MED5.6%
——2Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint (syncapi/routing/context.go) that allows authenticated local users to access post-leave room state events by exploiting a flawed membership check that evaluates only the RoomExists field while ignoring IsInRoom, HasBeenInRoom, and Membership fields. Attackers who have left a room can call the rooms context API endpoint for a previously permitted event and receive unfiltered current room state that the /messages and /sync endpoints correctly withhold.9dCVE-2024-51766—5.6%
——2——CVE-2023-32490—5.6%
——2——CVE-2022-50153—5.6%
——2——CVE-2021-3784—5.6%
——2——CVE-2026-606408.3 HIG5.6%
——2Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).3dCVE-2026-28230—5.6%
——2——CVE-2025-38327—5.6%
——2——CVE-2026-33426—5.6%
——2——CVE-2023-36836—5.6%
——2——CVE-2026-32679—5.6%
——2——CVE-2026-397045.3 MED5.6%
——2Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing – Pro precious-metals-automated-product-pricing-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Precious Metals Automated Product Pricing – Pro: from n/a through <= 4.0.5.8dCVE-2025-8736—5.6%
——2——CVE-2025-13939—5.6%
——2——CVE-2025-12880—5.6%
——2——CVE-2025-2274—5.6%
——2——CVE-2022-50032—5.6%
——2——CVE-2022-20506—5.6%
——2——CVE-2026-200747.4 HIG5.6%
——2A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) multi-instance routing feature of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the IS-IS process to restart unexpectedly.
This vulnerability is due to insufficient input validation of ingress IS-IS packets. An attacker could exploit this vulnerability by sending crafted IS-IS packets to an affected device after forming an adjacency. A successful exploit could allow the attacker to cause the IS-IS process to restart unexpectedly, resulting in a temporary loss of connectivity to advertised networks and a denial of service (DoS) condition.
Note: The IS-IS protocol is a routing protocol. To exploit this vulnerability, an attacker must be Layer 2-adjacent to the affected device and must have formed an adjacency. 24dCVE-2026-24784—5.6%
——2——CVE-2026-45870—5.6%
——2——