Vulnerabilities exploitable today
356,393in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,661
New KEV · 24H0
Exploit Today ≥ 701,603
Distribution · last window
- Critical2,794
- High11,183
- Medium7,442
- Low701
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-252597.8 HIG0.0%
——0Memory corruption while processing multiple IOCTL command for escape operations.15dCVE-2023-20942—0.0%
——0——CVE-2026-285777.8 HIG0.0%
——0In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2024-29779—0.0%
——0——CVE-2026-34862—0.0%
——0——CVE-2025-486485.5 MED0.0%
——0In isSameApp of NotificationManagerService.java, there is a possible persistent dos due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.16dCVE-2023-20750—0.0%
——0——CVE-2023-20787—0.0%
——0——CVE-2026-0153—0.0%
——0——CVE-2025-463713.6 LOW0.0%
——0Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the ssh. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.14dCVE-2025-54651—0.0%
——0——CVE-2026-3229—0.0%
——0——CVE-2024-53016—0.0%
——0——CVE-2026-21002—0.0%
——0——CVE-2025-47374—0.0%
——0——CVE-2026-112905.0 MED0.0%
——0Integer overflow in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to cause a denial of service via a malicious file. (Chromium security severity: Low)15dCVE-2025-596156.6 MED0.0%
——0Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization.30dCVE-2025-48575—0.0%
——0——CVE-2025-36921—0.0%
——0——CVE-2025-47330—0.0%
——0——CVE-2023-37395—0.0%
——0——CVE-2026-58212——
——0Rejected reason: Further research determined the issue is not a vulnerability based on CNA Rule 4.1.12 The act of updating Product dependencies MUST NOT be determined to be a Vulnerability, regardless of whether the dependencies have Vulnerabilities.29dCVE-2026-62168——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61443. Reason: This candidate is a duplicate of CVE-2026-61443. Notes: All CVE users should reference CVE-2026-61443 instead of this candidate.22dCVE-2026-62173——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61433. Reason: This candidate is a duplicate of CVE-2026-61433. Notes: All CVE users should reference CVE-2026-61433 instead of this candidate.22dCVE-2025-47407—0.0%
——0——CVE-2026-51282——
——0Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.6dCVE-2026-51241——
——0Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.6dCVE-2023-20940—0.0%
——0——CVE-2026-62172——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61436. Reason: This candidate is a duplicate of CVE-2026-61436. Notes: All CVE users should reference CVE-2026-61436 instead of this candidate.22dCVE-2025-66333—0.0%
——0——CVE-2026-62174——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61435. Reason: This candidate is a duplicate of CVE-2026-61435. Notes: All CVE users should reference CVE-2026-61435 instead of this candidate.22dCVE-2026-66051——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.8dCVE-2026-101286.5 MED—
——0IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow component to read arbitrary server environment variables, exposing sensitive secrets despite security controls intended to disable custom components.7hCVE-2026-176257.2 HIG—
——0IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.7hCVE-2026-704284.3 MED—
——0Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system.1dCVE-2026-704405.4 MED—
——0Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.1dCVE-2026-704415.4 MED—
——0Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Create or Item/Configure permission.1dCVE-2026-704424.3 MED—
——0Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to use.1dCVE-2026-704434.3 MED—
——0Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL.1dCVE-2026-704444.3 MED—
——0A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.1d