Vulnerabilities exploitable today
352,317in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,653
New KEV · 24H0
Exploit Today ≥ 701,590
Distribution · last window
- Critical2,257
- High7,708
- Medium7,032
- Low663
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-10716—3.1%
——1——CVE-2025-25086—3.1%
——1——CVE-2026-46078—3.1%
——1——CVE-2022-48518—3.1%
——1——CVE-2026-53694—3.1%
——1Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Nomachine allows Argument Injection.This issue affects Nomachine: before 9.5.7, before 8.23.2.18dCVE-2025-31617—3.1%
——1——CVE-2025-31623—3.1%
——1——CVE-2023-28142—3.1%
——1——CVE-2025-58794—3.1%
——1——CVE-2026-21791—3.1%
——1——CVE-2023-51433—3.1%
——1——CVE-2022-32598—3.1%
——1——CVE-2024-1343—3.1%
——1——CVE-2025-31906—3.1%
——1——CVE-2022-33918—3.1%
——1——CVE-2026-46203—3.1%
——1——CVE-2021-20435—3.1%
——1——CVE-2021-26735—3.1%
——1——CVE-2026-46204—3.1%
——1——CVE-2025-25100—3.1%
——1——CVE-2026-46191—3.1%
——1——CVE-2025-46495—3.1%
——1——CVE-2025-564386.8 MED3.1%
——1An issue in the firmware update mechanism of Nous W3 Smart WiFi Camera v1.33.50.82 allows unauthenticated and physically proximate attackers to escalate privileges to root via supplying a crafted update.tar archive file stored on a FAT32-formatted SD card.20dCVE-2025-32037—3.1%
——1——CVE-2019-9271—3.1%
——1——CVE-2025-61145—3.1%
——1——CVE-2023-31323—3.1%
——1——CVE-2025-36938—3.1%
——1——CVE-2026-41970—3.1%
——1——CVE-2026-532237.1 HIG3.1%
——1In the Linux kernel, the following vulnerability has been resolved:
net: guard timestamp cmsgs to real error queue skbs
skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb
from sk_error_queue. That assumption is not true for AF_PACKET sockets:
outgoing packet taps are also delivered to packet sockets with
skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET
instead of struct sock_exterr_skb.
If such an skb is received with timestamping enabled, the generic
timestamp cmsg path can read AF_PACKET control-buffer state as
sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop
counter overlaps opt_stats. An odd drop count makes the path emit
SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear
skbs this copies past the linear head and can trigger hardened usercopy or
disclose adjacent heap contents.
Keep skb_is_err_queue() local to net/socket.c, but make it verify that
the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor
installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal
receive ownership and no longer pass as error-queue skbs, while legitimate
sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free
ownership.23dCVE-2025-38207—3.1%
——1——CVE-2020-0496—3.1%
——1——CVE-2026-584816.5 MED3.1%
——1Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment checks use raw string prefix tests. A sandbox base such as `/tmp/network-ai-sandbox` also matches a sibling path such as `/tmp/network-ai-sandbox_evil/secret.txt`. An agent/user that can call `AgentRuntime.readFile()` or `AgentRuntime.listDir()` can read or list files outside the intended sandbox when the target path is in a sibling directory sharing the base path prefix. This breaks the documented sandbox boundary. The issue is fixed in v5.12.2. `SandboxPolicy.resolvePath()` and `isPathAllowed()` now use separator-anchored prefix checks (`resolved === base || resolved.startsWith(base + path.sep)`) for both the allow-list and block-list. A sibling directory that merely shares a name prefix (e.g. `/srv/app-evil` vs base `/srv/app`) is no longer treated as in-scope.4dCVE-2026-46218—3.1%
——1——CVE-2021-0454—3.1%
——1——CVE-2023-25773—3.1%
——1——CVE-2025-58798—3.1%
——1——CVE-2023-32663—3.1%
——1——CVE-2023-31246—3.1%
——1——CVE-2026-43076—3.1%
——1——