Vulnerabilities exploitable today
352,772in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,653
New KEV · 24H0
Exploit Today ≥ 701,590
Distribution · last window
- Critical2,281
- High7,876
- Medium7,167
- Low676
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-33327—3.2%
——1libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1.2dCVE-2026-7562—3.2%
——1——CVE-2025-36462—3.2%
——1——CVE-2025-36461—3.2%
——1——CVE-2022-21778—3.2%
——1——CVE-2025-14845—3.2%
——1——CVE-2025-37940—3.2%
——1——CVE-2025-22634—3.2%
——1——CVE-2021-0443—3.2%
——1——CVE-2020-11152—3.2%
——1——CVE-2022-20052—3.2%
——1——CVE-2021-39668—3.2%
——1——CVE-2025-26910—3.2%
——1——CVE-2022-33986—3.2%
——1——CVE-2025-0712—3.2%
——1——CVE-2025-53267—3.2%
——1——CVE-2026-24360—3.2%
——1——CVE-2026-32044—3.2%
——1——CVE-2026-113094.3 MED3.2%
——1Insufficient policy enforcement in History in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)2dCVE-2020-0206—3.2%
——1——CVE-2019-25463—3.2%
——1——CVE-2026-640737.8 HIG3.2%
——1In the Linux kernel, the following vulnerability has been resolved:
irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
On PREEMPT_RT, non-HARD irq_work runs in per-CPU kthreads via
run_irq_workd(), so irq_work_sync() uses rcuwait() to wait for BUSY==0.
After irq_work_single() clears BUSY via atomic_cmpxchg(), it still
dereferences @work for irq_work_is_hard() and rcuwait_wake_up().
An irq_work_sync() caller on another CPU that enters after BUSY is cleared
can observe BUSY==0 immediately, return, and free the work before those
accesses complete — causing a use-after-free.
Fix this by wrapping run_irq_workd() in guard(rcu)() so that the entire
irq_work_single() execution is within an RCU read-side critical
section. Then add synchronize_rcu() in irq_work_sync() after
rcuwait_wait_event() to ensure the caller waits for the RCU grace period
before returning, preventing premature frees.5dCVE-2025-23972—3.2%
——1——CVE-2025-61659—3.2%
——1——CVE-2022-32267—3.2%
——1——CVE-2025-20885—3.2%
——1——CVE-2025-9945—3.2%
——1——CVE-2024-5022—3.2%
——1——CVE-2026-4387—3.2%
——1StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file located at C:\Users\<username>\.sdm\state.kv. The file is protected only by default user-level NTFS permissions.
Exploitation requires local read access to the affected user's profile directory and additional deployment and execution conditions on the target host.
The condition was reported through coordinated disclosure by Hope Walker (SpecterOps).3dCVE-2025-30101—3.2%
——1——CVE-2025-54969—3.2%
——1——CVE-2026-23318—3.2%
——1——CVE-2025-49965—3.2%
——1——CVE-2026-470223.3 LOW3.2%
——1Vulnerability in the GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security). The supported version that is affected is 26.1.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where GoldenGate Stream Analytics executes to compromise GoldenGate Stream Analytics. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of GoldenGate Stream Analytics. CVSS 3.1 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).2dCVE-2026-84224.3 MED3.2%
——1The Remove meta boxes per user role plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.01. This is due to missing or incorrect nonce validation on the 'remove-meta-boxes-per-user-role' page. This makes it possible for unauthenticated attackers to modify or reset the plugin's per-role meta box visibility settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.3dCVE-2026-74547.8 HIG3.2%
——1A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.2dCVE-2025-36909—3.2%
——1——CVE-2025-14615—3.2%
——1——CVE-2026-417144.0 MED3.2%
——1Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.2dCVE-2025-49977—3.2%
——1——