Vulnerabilities exploitable today
354,756in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,656
New KEV · 24H0
Exploit Today ≥ 701,601
Distribution · last window
- Critical2,593
- High9,274
- Medium7,512
- Low706
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-54683—5.6%
——2——CVE-2025-71107—5.6%
——2——CVE-2026-45925—5.6%
——2——CVE-2020-25280—5.6%
——2——CVE-2024-22016—5.6%
——2——CVE-2026-20990—5.6%
——2——CVE-2021-1913—5.6%
——2——CVE-2026-112914.3 MED5.6%
——2Inappropriate implementation in Android Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)9dCVE-2026-1574—5.6%
——2——CVE-2021-22398—5.6%
——2——CVE-2023-33022—5.5%
——2——CVE-2025-38693—5.5%
——2——CVE-2025-35983—5.5%
——2——CVE-2021-38483—5.5%
——2——CVE-2023-33092—5.5%
——2——CVE-2022-50118—5.5%
——2——CVE-2022-50062—5.5%
——2——CVE-2026-639187.8 HIG5.5%
——2In the Linux kernel, the following vulnerability has been resolved:
l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
A reader in l2tp_session_get_by_ifname() can return a pointer to a
session whose refcount has reached zero. The getter takes its
reference with plain refcount_inc(), but every other session getter
in the same file (l2tp_v2_session_get, l2tp_v3_session_get, and the
corresponding _get_next variants) uses refcount_inc_not_zero()
because the IDR/RCU lookup can race with refcount_dec_and_test() ->
l2tp_session_free() -> kfree_rcu(). The ifname getter is the only
outlier; the inconsistency was raised on-list after 979c017803c4
("l2tp: use list_del_rcu in l2tp_session_unhash").
A reader inside rcu_read_lock_bh() that matches session->ifname can
be preempted between the strcmp() and the refcount_inc(). If the
last reference drops on another CPU in that window, the reader's
refcount_inc() runs on a counter that has reached zero. refcount_t
catches the addition-on-zero, prints "refcount_t: addition on 0;
use-after-free", saturates the counter, and returns the saturated
pointer to the caller. Session memory is held live by the in-flight
RCU read section, but the kfree_rcu() callback queued from
l2tp_session_free() will free it once the grace period closes; a
caller that dereferences the returned session past that point hits
a slab-use-after-free. On PREEMPT_RT local_bh_disable() is a per-CPU
sleeping lock and the preemption window is real; on stock PREEMPT
kernels local_bh_disable() is a preempt_count increment that closes
the cross-CPU race in practice (see below).
Use refcount_inc_not_zero() and continue the list walk on failure,
matching the other session getters in the file. The ifname getter
is the only session getter in net/l2tp/ that still uses the bare
refcount_inc() pattern; this change restores file-internal
consistency. The success path is unchanged.5dCVE-2026-642657.8 HIG5.5%
——2In the Linux kernel, the following vulnerability has been resolved:
fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
When fuse_resend() moves a request from fpq->processing back to
fiq->pending, it sets FR_PENDING and clears FR_SENT but does not
remove the requests intr_entry from fiq->interrupts. If the
request had FR_INTERRUPTED set from a prior signal, intr_entry
remains dangling on fiq->interrupts. When the requesting task
then receives a fatal signal, fuse_remove_pending_req() sees
FR_PENDING=1, removes the request from fiq->pending and frees it
via the refcount path, also without cleaning intr_entry. The
stale intr_entry causes use-after-free when fuse_read_interrupt()
iterates fiq->interrupts:
- list_del_init(&req->intr_entry) -> UAF write on freed slab
- req->in.h.unique -> UAF read, data leaked to userspace
Remove intr_entry from fiq->interrupts in fuse_resend() for
interrupted requests before they are placed back on fiq->pending.
Add a WARN_ON if the intr_entry is not empty on request destruction.2dCVE-2025-38006—5.5%
——2——CVE-2026-1745—5.5%
——2——CVE-2022-50121—5.5%
——2——CVE-2023-33088—5.5%
——2——CVE-2025-38059—5.5%
——2——CVE-2022-21789—5.5%
——2——CVE-2026-245114.4 MED5.5%
——2Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.0, contains a generation of error message containing sensitive information vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure.8dCVE-2025-58255—5.5%
——2——CVE-2025-46339—5.5%
——2——CVE-2026-58944.3 MED5.5%
——2Inappropriate implementation in PDF in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)8dCVE-2025-58244—5.5%
——2——CVE-2026-34549—5.5%
——2——CVE-2022-50155—5.5%
——2——CVE-2026-35252—5.5%
——2——CVE-2026-45882—5.5%
——2——CVE-2025-59572—5.5%
——2——CVE-2025-58013—5.5%
——2——CVE-2025-59587—5.5%
——2——CVE-2026-2815—5.5%
——2——CVE-2025-59585—5.5%
——2——CVE-2026-111866.1 MED5.5%
——2Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)9d