Vulnerabilities exploitable today
354,689in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,656
New KEV · 24H0
Exploit Today ≥ 701,601
Distribution · last window
- Critical2,617
- High9,375
- Medium7,592
- Low711
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-30641—5.3%
——2——CVE-2023-21429—5.3%
——2——CVE-2025-53881—5.3%
——2——CVE-2026-21768—5.3%
——2——CVE-2023-40596—5.3%
——2——CVE-2023-0864—5.3%
——2——CVE-2022-44732—5.3%
——2——CVE-2024-37133—5.3%
——2——CVE-2025-39828—5.3%
——2——CVE-2025-61863—5.3%
——2——CVE-2025-61864—5.3%
——2——CVE-2024-23583—5.3%
——2——CVE-2025-52919—5.3%
——2——CVE-2024-37126—5.3%
——2——CVE-2021-33075—5.3%
——2——CVE-2020-0079—5.3%
——2——CVE-2025-20155—5.3%
——2——CVE-2026-397005.3 MED5.3%
——2Missing Authorization vulnerability in WPXPO WowOptin optin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowOptin: from n/a through <= 1.4.32.8dCVE-2026-142314.3 MED5.3%
——2The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.2dCVE-2024-32854—5.3%
——2——CVE-2026-141882.7 LOW5.3%
——2The Easy Appointments WordPress plugin through 3.12.26 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.2dCVE-2021-39796—5.3%
——2——CVE-2025-5467—5.3%
——2——CVE-2025-55307—5.3%
——2——CVE-2026-22716—5.3%
——2——CVE-2025-49848—5.3%
——2——CVE-2025-505866.5 MED5.3%
——2StudentManage v1.0 was discovered to contain Cross-Site Request Forgery (CSRF).27dCVE-2025-59138—5.3%
——2——CVE-2026-151665.5 MED5.3%
——2IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service23dCVE-2020-27066—5.3%
——2——CVE-2024-20462—5.3%
——2——CVE-2024-44097—5.3%
——2——CVE-2019-25691—5.3%
——2——CVE-2025-39835—5.3%
——2——CVE-2021-22126—5.3%
——2——CVE-2022-22484—5.3%
——2——CVE-2026-83577.8 HIG5.3%
——2LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens. The array that tracks nesting depth was allocated one element too small for that worst case, so such a formula wrote one element past its end. In fixed versions the array is sized to hold the largest possible nesting.4dCVE-2026-44592—5.3%
——2——CVE-2026-64233—5.3%
——2In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
uvc_function_bind() walks &opts->extension_units twice without holding
opts->lock:
- directly, for the iExtension string-descriptor fixup loop;
- indirectly, four times via uvc_copy_descriptors() (once per speed),
where the helper iterates uvc->desc.extension_units (which aliases
&opts->extension_units) to size and emit XU descriptors.
The configfs side (uvcg_extension_make / uvcg_extension_drop, in
drivers/usb/gadget/function/uvc_configfs.c) takes opts->lock around its
list_add_tail / list_del operations. A privileged userspace process
that holds the configfs subtree open and writes the gadget UDC name
to bind the function while concurrently rmdir()'ing an extensions
subdir can race uvcg_extension_drop() against the bind-time list walks
and dereference a freed struct uvcg_extension.
Hold opts->lock from the start of the XU string-descriptor fixup
through the last uvc_copy_descriptors() call, releasing on the
descriptor-error path via a new error_unlock label that drops the
lock before falling through to the existing error label. This
matches the locking discipline of the configfs callbacks and removes
the only remaining unsynchronised reader of the XU list during bind.
Reachability: only privileged processes that can mount configfs and
write to gadget UDC files can trigger the race, so this is a
correctness fix rather than a security boundary.2dCVE-2026-64253—5.3%
——2In the Linux kernel, the following vulnerability has been resolved:
kernel/fork: clear PF_BLOCK_TS in copy_process()
PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is
non-NULL, and blk_finish_plug() clears it via __blk_flush_plug()
before NULLing the plug pointer. copy_process() breaks the
invariant by inheriting PF_BLOCK_TS from the parent while resetting
the child's plug to NULL.
Clear PF_BLOCK_TS alongside that assignment so callers can rely on
"PF_BLOCK_TS set implies current->plug != NULL" and dereference
current->plug unguarded.2d