Vulnerabilities exploitable today
354,689in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,656
New KEV · 24H0
Exploit Today ≥ 701,601
Distribution · last window
- Critical2,617
- High9,374
- Medium7,592
- Low711
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-36353—5.4%
——2——CVE-2025-14449—5.4%
——2——CVE-2025-13608—5.4%
——2——CVE-2026-7979—5.4%
——2——CVE-2025-38054—5.4%
——2——CVE-2026-32091—5.4%
——2——CVE-2025-383037.8 HIG5.4%
——2In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: eir: Fix possible crashes on eir_create_adv_data
eir_create_adv_data may attempt to add EIR_FLAGS and EIR_TX_POWER
without checking if that would fit.2dCVE-2025-50072—5.4%
——2——CVE-2022-50024—5.4%
——2——CVE-2024-36342—5.4%
——2——CVE-2021-39634—5.4%
——2——CVE-2026-563743.3 LOW5.4%
——2ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due to missing boundary checks when parsing ftxt:format. Remote attackers can trigger an out of bounds read by crafting malicious FTXT image files to cause denial of service or information disclosure.23dCVE-2025-8669—5.4%
——2——CVE-2023-20599—5.4%
——2——CVE-2025-0610—5.4%
——2——CVE-2023-33087—5.4%
——2——CVE-2021-22469—5.4%
——2——CVE-2026-43895—5.4%
——2——CVE-2023-30719—5.4%
——2——CVE-2022-30548—5.4%
——2——CVE-2026-502567.8 HIG5.4%
——2A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.5dCVE-2025-38038—5.4%
——2——CVE-2025-13728—5.4%
——2——CVE-2026-7986—5.4%
——2——CVE-2025-43934—5.4%
——2——CVE-2026-21352—5.4%
——2——CVE-2025-1762—5.4%
——2——CVE-2026-2542—5.4%
——2——CVE-2025-38047—5.4%
——2——CVE-2026-24051—5.4%
——2——CVE-2025-7960—5.4%
——2——CVE-2026-2242—5.4%
——2——CVE-2026-351698.7 HIG5.4%
——2LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From to before 27.0.3 and 28.0.1, the help_editor module of LORIS did not properly sanitize some user supplied variables which could result in a reflected cross-site scripting attack if a user is tricked into following an invalid link. The same input vector could also allow an attacker to download arbitrary markdown files on an unpatched server. This vulnerability is fixed in 27.0.3 and 28.0.1.8dCVE-2026-8784—5.4%
——2——CVE-2024-12837—5.4%
——2——CVE-2026-4621—5.4%
——2——CVE-2025-12650—5.4%
——2——CVE-2026-152128.8 HIG5.3%
——2The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option 'enable_nonce_check', which is absent from the default 'wpo365_options' array and therefore evaluates to false via get_global_boolean_var(); as a result, the wp_ajax_wpo365_update_settings handler (Ajax_Service::update_settings) accepts POSTs from cross-origin pages and forwards the attacker-supplied 'settings' payload (base64/JSON) to Options_Service::update_options(), which merges every key/value into wpo365_options without a key allowlist. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin options — including enabling the SCIM REST endpoint (enable_scim), planting an attacker-known scim_secret_token, and setting new_usr_default_role to 'administrator' — via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.8dCVE-2020-0031—5.4%
——2——CVE-2025-13231—5.4%
——2——