Vulnerabilities exploitable today
351,837in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,651
New KEV · 24H0
Exploit Today ≥ 701,587
Distribution · last window
- Critical1,811
- High5,855
- Medium4,717
- Low452
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-533145.5 MED1.8%
——1In the Linux kernel, the following vulnerability has been resolved:
padata: Put CPU offline callback in ONLINE section to allow failure
syzbot reported the following warning:
DEAD callback error for CPU1
WARNING: kernel/cpu.c:1463 at _cpu_down+0x759/0x1020 kernel/cpu.c:1463, CPU#0: syz.0.1960/14614
at commit 4ae12d8bd9a8 ("Merge tag 'kbuild-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux")
which tglx traced to padata_cpu_dead() given it's the only
sub-CPUHP_TEARDOWN_CPU callback that returns an error.
Failure isn't allowed in hotplug states before CPUHP_TEARDOWN_CPU
so move the CPU offline callback to the ONLINE section where failure is
possible.16dCVE-2024-0036—1.8%
——1——CVE-2026-48981—1.8%
——1——CVE-2026-255996.3 MED1.8%
——1Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices communicating with the Orca server over an
unencrypted and unauthenticated HTTP connection on a non-secure port specifically enable an
attacker to impersonate a legitimate device and inject malicious
payloads. This enables the insertion of harmful code directly
into the Orca user portal, potentially compromising user accounts,
exposing sensitive information, and allowing further unauthorized
actions within the portal.12hCVE-2025-25217—1.8%
——1——CVE-2026-7279—1.8%
——1——CVE-2021-0538—1.8%
——1——CVE-2023-31306—1.8%
——1——CVE-2022-43125.5 MED1.8%
——1
A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could
allow an unauthorized user with access the email and short messaging service (SMS) accounts configuration files
to discover the associated simple mail transfer protocol (SMTP) account credentials and the SIM card PIN code.
Successful exploitation of this vulnerability could allow an unauthorized user access to the underlying email
account and SIM card.
13dCVE-2023-20767—1.8%
——1——CVE-2022-25717—1.8%
——1——CVE-2022-33301—1.8%
——1——CVE-2025-27242—1.8%
——1——CVE-2025-52516—1.8%
——1——CVE-2026-23426—1.8%
——1——CVE-2026-45846—1.8%
——1——CVE-2022-33267—1.8%
——1——CVE-2026-4134—1.8%
——1——CVE-2019-2119—1.8%
——1——CVE-2025-36083—1.8%
——1——CVE-2026-8435—1.8%
——1——CVE-2026-35367—1.8%
——1——CVE-2026-46249—1.8%
——1——CVE-2025-0123—1.8%
——1——CVE-2026-23150—1.8%
——1——CVE-2022-33298—1.8%
——1——CVE-2021-0542—1.8%
——1——CVE-2021-0376—1.8%
——1——CVE-2025-20063—1.8%
——1——CVE-2022-33230—1.8%
——1——CVE-2026-31681—1.8%
——1——CVE-2022-33224—1.8%
——1——CVE-2023-20766—1.8%
——1——CVE-2023-20760—1.8%
——1——CVE-2026-8142—1.8%
——1——CVE-2026-231545.5 MED1.8%
——1In the Linux kernel, the following vulnerability has been resolved:
net: fix segmentation of forwarding fraglist GRO
This patch enhances GSO segment handling by properly checking
the SKB_GSO_DODGY flag for frag_list GSO packets, addressing
low throughput issues observed when a station accesses IPv4
servers via hotspots with an IPv6-only upstream interface.
Specifically, it fixes a bug in GSO segmentation when forwarding
GRO packets containing a frag_list. The function skb_segment_list
cannot correctly process GRO skbs that have been converted by XLAT,
since XLAT only translates the header of the head skb. Consequently,
skbs in the frag_list may remain untranslated, resulting in protocol
inconsistencies and reduced throughput.
To address this, the patch explicitly sets the SKB_GSO_DODGY flag
for GSO packets in XLAT's IPv4/IPv6 protocol translation helpers
(bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO
packets as potentially modified after protocol translation. As a
result, GSO segmentation will avoid using skb_segment_list and
instead falls back to skb_segment for packets with the SKB_GSO_DODGY
flag. This ensures that only safe and fully translated frag_list
packets are processed by skb_segment_list, resolving protocol
inconsistencies and improving throughput when forwarding GRO packets
converted by XLAT.8dCVE-2022-20547—1.8%
——1——CVE-2023-46294—1.8%
——1——CVE-2024-3082—1.8%
——1——CVE-2023-20761—1.8%
——1——