Vulnerabilities exploitable today
354,538in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,656
New KEV · 24H0
Exploit Today ≥ 701,601
Distribution · last window
- Critical2,647
- High9,476
- Medium7,699
- Low698
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-53364—4.9%
——1——CVE-2024-43114—4.9%
——1——CVE-2024-58262—4.9%
——1——CVE-2026-529697.8 HIG4.9%
——1In the Linux kernel, the following vulnerability has been resolved:
KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
kvm_reset_dirty_gfn() guards the gfn range with
if (!memslot || (offset + __fls(mask)) >= memslot->npages)
return;
but offset is u64 and the addition is unchecked. The check can be
silently bypassed by a u64 wrap.
The dirty ring backing those entries is MAP_SHARED at
KVM_DIRTY_LOG_PAGE_OFFSET of the vcpu fd, so the VMM can rewrite the
slot and offset fields of any entry between when the kernel pushes
them and when KVM_RESET_DIRTY_RINGS consumes them. On reset,
kvm_dirty_ring_reset() re-reads the values via READ_ONCE() and feeds
them straight back into this check; only the flags handshake is
treated as the handover, the slot/offset payload is taken on trust.
Crafting two entries
entry[i].offset = 0xffffffffffffffc1
entry[i+1].offset = 0
makes the coalescing loop in kvm_dirty_ring_reset() compute
delta = (s64)(0 - 0xffffffffffffffc1) = 63
which falls in [0, BITS_PER_LONG), so it folds entry[i+1] into the
existing mask by setting bit 63. The trailing kvm_reset_dirty_gfn()
call then sees offset = 0xffffffffffffffc1 and __fls(mask) = 63;
the sum is 0 in u64 and the bounds check passes.
That offset propagates into kvm_arch_mmu_enable_log_dirty_pt_masked()
unchanged. On the legacy MMU path -- kvm_memslots_have_rmaps() ==
true, i.e. shadow paging, any VM that has allocated shadow roots, or
a write-tracked slot -- it reaches gfn_to_rmap(), which indexes
slot->arch.rmap[0][] with a near-U64_MAX gfn. That is an
out-of-bounds load of a kvm_rmap_head, followed by a conditional
clear of PT_WRITABLE_MASK in whatever the loaded pointer points at.
The path is reachable from any process holding /dev/kvm.
Range-check offset on its own first, so the addition cannot wrap.
memslot->npages is bounded well below U64_MAX, so once offset <
npages holds, offset + __fls(mask) (with __fls(mask) < BITS_PER_LONG)
stays in range.16dCVE-2022-50474—4.9%
——1——CVE-2024-53729—4.9%
——1——CVE-2023-51430—4.9%
——1——CVE-2026-3822—4.9%
——1——CVE-2023-53201—4.9%
——1——CVE-2021-0365—4.9%
——1——CVE-2026-25016—4.9%
——1——CVE-2026-6342—4.9%
——1——CVE-2025-54623—4.9%
——1——CVE-2018-9340—4.9%
——1——CVE-2026-45147—4.9%
——1——CVE-2024-56232—4.9%
——1——CVE-2021-1962—4.9%
——1——CVE-2026-25459—4.9%
——1——CVE-2025-65107—4.9%
——1——CVE-2024-20853—4.9%
——1——CVE-2025-27438—4.9%
——1——CVE-2025-69344—4.9%
——1——CVE-2025-20197—4.9%
——1——CVE-2026-0030—4.9%
——1——CVE-2021-37644—4.9%
——1——CVE-2025-69345—4.9%
——1——CVE-2026-0031—4.9%
——1——CVE-2025-68878—4.9%
——1——CVE-2021-27481—4.9%
——1——CVE-2024-53781—4.9%
——1——CVE-2023-27301—4.9%
——1——CVE-2024-5462—4.9%
——1——CVE-2026-0618—4.9%
——1——CVE-2026-45040—4.9%
——1——CVE-2025-23707—4.9%
——1——CVE-2024-13826—4.9%
——1——CVE-2025-40573—4.9%
——1——CVE-2021-35094—4.9%
——1——CVE-2026-21355—4.9%
——1——CVE-2025-54022—4.9%
——1——