Vulnerabilities exploitable today
354,756in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,656
New KEV · 24H0
Exploit Today ≥ 701,601
Distribution · last window
- Critical2,597
- High9,307
- Medium7,551
- Low708
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2022-50036—5.5%
——2——CVE-2025-2027—5.5%
——2——CVE-2026-45851—5.5%
——2——CVE-2022-50132—5.5%
——2——CVE-2026-3290—5.5%
——2——CVE-2025-59589—5.5%
——2——CVE-2026-26304—5.5%
——2——CVE-2026-112736.1 MED5.5%
——2Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)9dCVE-2024-9133—5.5%
——2——CVE-2022-50145—5.5%
——2——CVE-2025-61147—5.5%
——2——CVE-2025-571976.0 MED5.5%
——2In the Payeer Android application 2.5.0, an improper access control vulnerability exists in the authentication flow for the PIN change feature. A local attacker with root access to the device can dynamically instrument the app to bypass the current PIN verification check and directly modify the authentication PIN. This allows unauthorized users to change PIN without knowing the original/current PIN.28dCVE-2022-501145.5 MED5.5%
——2In the Linux kernel, the following vulnerability has been resolved:
net: 9p: fix refcount leak in p9_read_work() error handling
p9_req_put need to be called when m->rreq->rc.sdata is NULL to avoid
temporary refcount leak.
[Dominique: commit wording adjustments, p9_req_put argument fixes for rebase]28dCVE-2025-59584—5.5%
——2——CVE-2025-38274—5.5%
——2——CVE-2026-34554—5.5%
——2——CVE-2022-50146—5.5%
——2——CVE-2025-38683—5.5%
——2——CVE-2026-30892—5.5%
——2——CVE-2022-50139—5.5%
——2——CVE-2026-425757.5 HIG5.5%
——2apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and available via ChecksumString(), and the downloaded package control hash is computed, but the two values are never compared in getPackageImpl(). Mismatched packages are silently accepted. An attacker who can substitute download responses (compromised mirror, HTTP repository, poisoned CDN cache) can install arbitrary packages into built images. This issue has been patched in version 1.2.7.8dCVE-2025-59586—5.5%
——2——CVE-2022-50130—5.5%
——2——CVE-2025-38014—5.5%
——2——CVE-2023-42918—5.5%
——2——CVE-2022-50055—5.5%
——2——CVE-2022-50089—5.5%
——2——CVE-2025-38695—5.5%
——2——CVE-2022-50154—5.5%
——2——CVE-2025-59585—5.5%
——2——CVE-2025-58833—5.5%
——2——CVE-2022-50047—5.5%
——2——CVE-2025-59592—5.5%
——2——CVE-2025-4407—5.5%
——2——CVE-2026-111866.1 MED5.5%
——2Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)9dCVE-2026-45882—5.5%
——2——CVE-2025-33229—5.5%
——2——CVE-2025-396815.5 MED5.5%
——2In the Linux kernel, the following vulnerability has been resolved:
x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
Since
923f3a2b48bd ("x86/resctrl: Query LLC monitoring properties once during boot")
resctrl_cpu_detect() has been moved from common CPU initialization code to
the vendor-specific BSP init helper, while Hygon didn't put that call in their
code.
This triggers a division by zero fault during early booting stage on our
machines with X86_FEATURE_CQM* supported, where get_rdt_mon_resources() tries
to calculate mon_l3_config with uninitialized boot_cpu_data.x86_cache_occ_scale.
Add the missing resctrl_cpu_detect() in the Hygon BSP init helper.
[ bp: Massage commit message. ]18dCVE-2022-50003—5.5%
——2——CVE-2025-38265—5.5%
——2——