Vulnerabilities exploitable today
351,724in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,651
New KEV · 24H0
Exploit Today ≥ 701,587
Distribution · last window
- Critical1,765
- High5,628
- Medium4,518
- Low412
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-31390—1.7%
——1——CVE-2026-23189—1.7%
——1——CVE-2023-6096—1.7%
——1——CVE-2025-11156—1.7%
——1——CVE-2025-43339—1.7%
——1——CVE-2021-39768—1.7%
——1——CVE-2020-9128—1.7%
——1——CVE-2026-155283.3 LOW1.7%
——1A vulnerability was found in lamaalrajih kicad-mcp up to 3.3.1. This issue affects some unknown processing of the file kicad_mcp/utils/path_validator.py. Performing a manipulation of the argument project_path/schematic_path results in protection mechanism failure. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.9dCVE-2025-10222—1.7%
——1——CVE-2016-20091—1.7%
——1——CVE-2021-26396—1.7%
——1——CVE-2021-25389—1.7%
——1——CVE-2024-42034—1.7%
——1——CVE-2025-7019—1.7%
——1——CVE-2026-21374—1.7%
——1——CVE-2026-638638.8 HIG1.7%
——1In the Linux kernel, the following vulnerability has been resolved:
drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()
There is a unbalanced lock/unlock to gpusvm notifier lock:
[ 931.045868] =====================================
[ 931.046509] WARNING: bad unlock balance detected!
[ 931.047149] 6.19.0-rc6+xe-**************** #9 Tainted: G U
[ 931.048150] -------------------------------------
[ 931.048790] kworker/u5:0/51 is trying to release lock (&gpusvm->notifier_lock) at:
[ 931.049801] [<ffffffffa090c0d8>] drm_gpusvm_scan_mm+0x188/0x460 [drm_gpusvm_helper]
[ 931.050802] but there are no more locks to release!
[ 931.051463]
The drm_gpusvm_notifier_unlock() sits under err_free label and the
first jump to err_free is just before calling the
drm_gpusvm_notifier_lock() causing unbalanced unlock.2dCVE-2021-0667—1.7%
——1——CVE-2025-52789—1.7%
——1——CVE-2026-43474—1.7%
——1——CVE-2026-43479—1.7%
——1——CVE-2021-0664—1.7%
——1——CVE-2021-0977—1.7%
——1——CVE-2024-49784—1.6%
——0——CVE-2024-20280—1.6%
——0——CVE-2026-43191—1.6%
——0——CVE-2021-39810—1.6%
——0——CVE-2021-0413—1.6%
——0——CVE-2025-71155—1.6%
——0——CVE-2025-27812—1.6%
——0——CVE-2023-20708—1.6%
——0——CVE-2026-55669—1.6%
——0——CVE-2021-0410—1.6%
——0——CVE-2023-21470—1.6%
——0——CVE-2026-533075.5 MED1.6%
——0In the Linux kernel, the following vulnerability has been resolved:
pinctrl: pinconf-generic: Fully validate 'pinmux' property
The pinconf_generic_parse_dt_pinmux() assumes that the 'pinmux' property
is not empty when present. This might be not true. With that, the allocator
will give a special value in return and not NULL which lead to the crash
when trying to access that (invalid) memory. Fix that by fully validating
'pinmux' value, including its length.16dCVE-2021-0411—1.6%
——0——CVE-2026-530787.8 HIG1.6%
——0In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
When a BPF sock_ops program accesses ctx fields with dst_reg == src_reg,
the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the
destination register in the !fullsock / !locked_tcp_sock path.
Both macros borrow a temporary register to check is_fullsock /
is_locked_tcp_sock when dst_reg == src_reg, because dst_reg holds the
ctx pointer. When the check is false (e.g., TCP_NEW_SYN_RECV state with
a request_sock), dst_reg should be zeroed but is not, leaving the stale
ctx pointer:
- SOCK_OPS_GET_SK: dst_reg retains the ctx pointer, passes NULL checks
as PTR_TO_SOCKET_OR_NULL, and can be used as a bogus socket pointer,
leading to stack-out-of-bounds access in helpers like
bpf_skc_to_tcp6_sock().
- SOCK_OPS_GET_FIELD: dst_reg retains the ctx pointer which the
verifier believes is a SCALAR_VALUE, leaking a kernel pointer.
Fix both macros by:
- Changing JMP_A(1) to JMP_A(2) in the fullsock path to skip the
added instruction.
- Adding BPF_MOV64_IMM(si->dst_reg, 0) after the temp register
restore in the !fullsock path, placed after the restore because
dst_reg == src_reg means we need src_reg intact to read ctx->temp.16hCVE-2025-53594—1.6%
——0——CVE-2022-20197—1.6%
——0——CVE-2025-48463—1.6%
——0——CVE-2026-3707—1.6%
——0——