Vulnerabilities exploitable today
351,929in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,653
New KEV · 24H0
Exploit Today ≥ 701,590
Distribution · last window
- Critical1,913
- High6,189
- Medium5,025
- Low479
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-8298—2.5%
——1——CVE-2026-31532—2.5%
——1——CVE-2026-23999—2.5%
——1——CVE-2025-40039—2.5%
——1——CVE-2026-9500—2.5%
——1——CVE-2026-24820—2.5%
——1——CVE-2026-35371—2.5%
——1——CVE-2024-36326—2.5%
——1——CVE-2026-57635—2.5%
——1——CVE-2025-8513—2.5%
——1——CVE-2026-23460—2.5%
——1——CVE-2019-25477—2.5%
——1——CVE-2026-0068—2.5%
——1——CVE-2021-39697—2.5%
——1——CVE-2021-0456—2.5%
——1——CVE-2025-31460—2.5%
——1——CVE-2025-68340—2.5%
——1——CVE-2025-67719—2.5%
——1——CVE-2021-0461—2.5%
——1——CVE-2024-25988—2.5%
——1——CVE-2023-33833—2.5%
——1——CVE-2026-21488—2.5%
——1——CVE-2019-25469—2.5%
——1——CVE-2026-23063—2.5%
——1——CVE-2026-560246.5 MED2.5%
——1Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal WP EasyPay allows Cross Site Request Forgery.
This issue affects WP EasyPay: from n/a through 4.5.0.22dCVE-2025-711145.5 MED2.5%
——1In the Linux kernel, the following vulnerability has been resolved:
via_wdt: fix critical boot hang due to unnamed resource allocation
The VIA watchdog driver uses allocate_resource() to reserve a MMIO
region for the watchdog control register. However, the allocated
resource was not given a name, which causes the kernel resource tree
to contain an entry marked as "<BAD>" under /proc/iomem on x86
platforms.
During boot, this unnamed resource can lead to a critical hang because
subsequent resource lookups and conflict checks fail to handle the
invalid entry properly.9dCVE-2025-156665.3 MED2.5%
——1A security vulnerability has been detected in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function Assimp::SceneCombiner::Copy of the file code/Common/SceneCombiner.cpp of the component Model File Handler. Such manipulation of the argument width/height leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. This and similar defects are tracked and handled via issue #6128.22dCVE-2026-480226.5 MED2.5%
——1@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port, so credentials are forwarded intact across same-host port changes and HTTPS-to-HTTP downgrades, allowing a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect to capture bearer tokens, session cookies, and proxy credentials and impersonate the victim against the upstream service. This issue is fixed in version 18.1.2.3dCVE-2025-33196—2.5%
——1——CVE-2026-23467—2.5%
——1——CVE-2026-43032—2.5%
——1——CVE-2024-23362—2.5%
——1——CVE-2026-23146—2.5%
——1——CVE-2026-39632—2.5%
——1——CVE-2026-35275—2.5%
——1——CVE-2026-411217.3 HIG2.5%
——1Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resolution Before File Access ('Link Following’) vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.17dCVE-2026-23468—2.5%
——1——CVE-2025-61792—2.5%
——1——CVE-2026-44468—2.5%
——1——CVE-2026-638707.8 HIG2.5%
——1In the Linux kernel, the following vulnerability has been resolved:
ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
The aoe driver (or similar) generates a non-IPv6 packet
(e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit()
on a 6LoWPAN interface (configured by the user or test case).
Since the packet is not IPv6, the 6LoWPAN header_ops->create function
(lowpan_header_create or header_create) returns early without initializing
the lowpan_addr_info structure in the skb headroom.
In the transmit function (lowpan_xmit), the driver calls lowpan_header
(or setup_header) which unconditionally copies and uses the lowpan_addr_info
from the headroom, which contains uninitialized data.
Fix this by dropping non IPv6 packets.
A similar fix is needed in net/bluetooth/6lowpan.c bt_xmit().3d