Vulnerabilities exploitable today
351,837in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,651
New KEV · 24H0
Exploit Today ≥ 701,587
Distribution · last window
- Critical1,811
- High5,855
- Medium4,717
- Low452
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2021-0689—1.8%
——1——CVE-2025-48930—1.8%
——1——CVE-2021-0894—1.8%
——1——CVE-2026-48147—1.8%
——1——CVE-2025-38448—1.8%
——1——CVE-2024-32482—1.8%
——1——CVE-2024-23458—1.8%
——1——CVE-2021-0895—1.8%
——1——CVE-2025-33237—1.8%
——1——CVE-2024-0037—1.8%
——1——CVE-2026-22989—1.8%
——1——CVE-2026-20629—1.8%
——1——CVE-2026-562885.5 MED1.8%
——1GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing.
An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.
This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f7223139dCVE-2021-0678—1.8%
——1——CVE-2025-64696—1.8%
——1——CVE-2024-23384—1.8%
——1——CVE-2025-20065—1.8%
——1——CVE-2026-40619—1.8%
——1——CVE-2022-20148—1.8%
——1——CVE-2021-0372—1.8%
——1——CVE-2026-146513.3 LOW1.8%
——1A vulnerability has been found in connorskees grass up to 0.13.4. The impacted element is the function grass_compiler::selector::extend/grass_compiler::evaluate::visitor. The manipulation leads to denial of service. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."16dCVE-2026-463145.5 MED1.8%
——1In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Reject empty multisync extension to prevent infinite loop
v3d_get_extensions() walks a userspace-provided singly-linked list of
ioctl extensions without any bound on the chain length. A local user
can craft a self-referential extension (ext->next == &ext) with zero
in_sync_count and out_sync_count, which bypasses the existing duplicate-
extension guard:
if (se->in_sync_count || se->out_sync_count)
return -EINVAL;
The guard never fires because v3d_get_multisync_post_deps() returns
immediately when count is zero, leaving both fields at zero on every
iteration. The result is an infinite loop in kernel context, blocking
the calling thread and pegging a CPU core indefinitely.
Fix this by rejecting a multisync extension where both in_sync_count
and out_sync_count are zero in v3d_get_multisync_submit_deps(). An
empty multisync carries no synchronization information and serves no
useful purpose, so returning -EINVAL for such an extension is the
correct defense against this attack vector.14dCVE-2024-31328—1.8%
——1——CVE-2026-2516—1.8%
——1——CVE-2025-6044—1.8%
——1——CVE-2026-54328—1.8%
——1——CVE-2025-31272—1.8%
——1——CVE-2026-24914—1.8%
——1——CVE-2021-0903—1.8%
——1——CVE-2026-31650—1.8%
——1——CVE-2026-20435—1.8%
——1——CVE-2023-35845—1.8%
——1——CVE-2025-30182—1.8%
——1——CVE-2025-38520—1.8%
——1——CVE-2026-156423.3 LOW1.8%
——1Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclude sensitive data is selected.7dCVE-2022-49920—1.8%
——1——CVE-2026-562895.5 MED1.8%
——1GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single block of changes in diff) line offsets in unified-diff input. A specially crafted patch can specify an extremely large line number, causing the application to enter an effectively infinite processing loop while attempting to locate the requested position.
This results in excessive CPU consumption and prevents the process from completing.
An attacker can trigger this behavior by supplying a malicious patch file, causing the utility to become unresponsive and require manual termination.
This issue has been fixed in the commit faba04ef4f2b410257f76c1b9dc85e350929c4b99dCVE-2025-48304—1.8%
——1——CVE-2025-20959—1.8%
——1——CVE-2020-37247—1.8%
——1——