Vulnerabilities exploitable today
351,929in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,653
New KEV · 24H0
Exploit Today ≥ 701,590
Distribution · last window
- Critical1,913
- High6,189
- Medium5,025
- Low479
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-46046—2.5%
——1——CVE-2026-23309—2.5%
——1——CVE-2026-49461—2.5%
——1——CVE-2026-46009—2.5%
——1——CVE-2022-20057—2.5%
——1——CVE-2026-23367—2.5%
——1——CVE-2026-20977—2.5%
——1——CVE-2026-20436—2.5%
——1——CVE-2025-42992—2.5%
——1——CVE-2026-23339—2.5%
——1——CVE-2022-33277—2.5%
——1——CVE-2026-43080—2.5%
——1——CVE-2022-20033—2.5%
——1——CVE-2026-40025—2.5%
——1——CVE-2026-43436—2.5%
——1——CVE-2022-20035—2.5%
——1——CVE-2026-25605—2.5%
——1——CVE-2026-23093—2.5%
——1——CVE-2026-31519—2.5%
——1——CVE-2026-46003—2.5%
——1——CVE-2025-4952—2.5%
——1——CVE-2022-490367.8 HIG2.5%
——1An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified vectors.14hCVE-2026-563641.9 LOW2.5%
——1ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.21dCVE-2025-54542—2.5%
——1——CVE-2026-533065.5 MED2.5%
——1In the Linux kernel, the following vulnerability has been resolved:
tty: hvc_iucv: fix off-by-one in number of supported devices
MAX_HVC_IUCV_LINES == HVC_ALLOC_TTY_ADAPTERS == 8.
This is the number of entries in:
static struct hvc_iucv_private *hvc_iucv_table[MAX_HVC_IUCV_LINES];
Sometimes hvc_iucv_table[] is limited by:
(a) if (num > hvc_iucv_devices) // for error detection
or
(b) for (i = 0; i < hvc_iucv_devices; i++) // in 2 places
(so these 2 don't agree; second one appears to be correct to me.)
hvc_iucv_devices can be 0..8. This is a counter.
(c) if (hvc_iucv_devices > MAX_HVC_IUCV_LINES)
If hvc_iucv_devices == 8, (a) allows the code to access hvc_iucv_table[8].
Oops.17dCVE-2026-532955.5 MED2.5%
——1In the Linux kernel, the following vulnerability has been resolved:
mailbox: add sanity check for channel array
Fail gracefully if there is no channel array attached to the mailbox
controller. Otherwise the later dereference will cause an OOPS which
might not be seen because mailbox controllers might instantiate very
early. Remove the comment explaining the obvious while here.15dCVE-2026-45941—2.5%
——1——CVE-2026-3928—2.5%
——1——CVE-2026-30883—2.5%
——1——CVE-2024-6476—2.5%
——1——CVE-2026-529165.5 MED2.5%
——1In the Linux kernel, the following vulnerability has been resolved:
batman-adv: frag: disallow unicast fragment in fragment
batadv_frag_skb_buffer() is called by batadv_batman_skb_recv() when a
BATADV_UNICAST_FRAG packet is received. Once all fragments are collected
and the packet is reassembled, batadv_recv_frag_packet() calls
batadv_batman_skb_recv() again to process the defragmented payload.
A malicious sender can craft a BATADV_UNICAST_FRAG packet whose reassembled
payload is itself a BATADV_UNICAST_FRAG packet (matryoshka-style nesting).
Each nesting level recurses through batadv_batman_skb_recv() without bound,
growing the kernel stack until it is exhausted.
Since refragmentation or fragments in fragments are not actually allowed,
discard all packets which are still BATADV_UNICAST_FRAG packets after the
defragmentation process.15dCVE-2024-51346—2.5%
——1——CVE-2026-601726.3 MED2.5%
——1Vulnerability in Oracle Autonomous Health Framework (component: Developer triaging platform). Supported versions that are affected are 26.0.0, 26.1.0 and 26.2.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).1dCVE-2026-603374.7 MED2.5%
——1Vulnerability in the Oracle Project Manufacturing product of Oracle E-Business Suite (component: PJM Command Center). The supported version that is affected is V16. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Project Manufacturing executes to compromise Oracle Project Manufacturing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Project Manufacturing accessible data as well as unauthorized update, insert or delete access to some of Oracle Project Manufacturing accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N).1dCVE-2026-31738—2.5%
——1——CVE-2026-23091—2.5%
——1——CVE-2022-33278—2.5%
——1——CVE-2016-200617.8 HIG2.5%
——1sheed AntiVirus 2.3 contains an unquoted service path vulnerability in the ShavProt service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can insert a malicious executable in the unquoted path and trigger service restart or system reboot to execute code with LocalSystem privileges.2dCVE-2022-20029—2.5%
——1——CVE-2026-31524—2.5%
——1——