Vulnerabilities exploitable today
358,455in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,662
New KEV · 24H0
Exploit Today ≥ 701,606
Distribution · last window
- Critical2,673
- High11,659
- Medium7,434
- Low690
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2021-47989——
———Rejected reason: This CVE ID has been rejected.11hCVE-2026-32791——
———Untrusted search path for some Intel(R) Performance Counter Monitor (Intel(R) PCM) before version tag 202604 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.9hCVE-2021-47988——
———Rejected reason: This CVE ID has been rejected.11hCVE-2020-37265——
———Rejected reason: This CVE ID has been rejected.11hCVE-2020-37264——
———Rejected reason: This CVE ID has been rejected.11hCVE-2020-37263——
———Rejected reason: This CVE ID has been rejected.11hCVE-2026-479224.7 MED—
———CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.9hCVE-2020-37261——
———Rejected reason: This CVE ID has been rejected.11hCVE-2020-37260——
———Rejected reason: This CVE ID has been rejected.11hCVE-2026-484387.5 HIG—
———CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.7hCVE-2020-37258——
———Rejected reason: This CVE ID has been rejected.11hCVE-2020-37257——
———Rejected reason: This CVE ID has been rejected.11hCVE-2026-73210——
———A Server-Side Request Forgery (SSRF) vulnerability existed in Lookyloo's PlaywrightCapture when the only_global_lookup option was enabled.
PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval was performed separately from the browser request-routing protections. Favicon URLs extracted from rendered HTML were resolved and subsequently fetched directly using an aiohttp.ClientSession.
An attacker able to supply or control a web page processed by PlaywrightCapture could include a crafted favicon reference, for example pointing to a loopback address, private IP address, or another resource reachable only from the PlaywrightCapture host. When the page was processed, the favicon retrieval routine could issue an HTTP request to this destination despite only_global_lookup being enabled.
This bypass could therefore be used to make the PlaywrightCapture host interact with internal network services that should not be reachable through a capture. Depending on the targeted service and its response, this could enable internal service discovery, access to internal resources, or interaction with HTTP endpoints available only from the capture infrastructure.
The patch introduces a common URL validation routine and applies it to favicon retrieval. Direct non-global IP addresses, localhost, .local domains, malformed URLs, and other explicitly non-public destinations are rejected before the favicon request is performed.
This fix is a complementary fix to CVE-2026-44439 - GCVE-0-2026-44439 - GHSA-687H-XW6F-Q2QW11hCVE-2026-51584——
———An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/auth_service.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject claim.12hCVE-2026-51583——
———An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address.12hCVE-2026-484465.5 MED—
———CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.9hCVE-2026-541137.5 HIG—
———Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network.4hCVE-2026-4805610.0 CRI—
———Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch.7hCVE-2026-591267.0 HIG—
———Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.6hCVE-2026-48046——
———Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote code execution. Version 2.5.0 contains a patch.12hCVE-2026-613527.5 HIG—
———Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.4hCVE-2026-619246.5 MED—
———Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.4hCVE-2026-626907.0 HIG—
———Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.8hCVE-2026-727806.5 MED—
———Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.8hCVE-2026-626996.8 MED—
———Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an unauthorized attacker to execute code with a physical attack.4hCVE-2026-627186.5 MED—
———Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.4hCVE-2026-627397.8 HIG—
———Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.8hCVE-2026-627456.5 MED—
———Integer underflow (wrap or wraparound) in Windows DHCP Server allows an unauthorized attacker to disclose information over an adjacent network.4hCVE-2026-627465.5 MED—
———Buffer over-read in Windows Win32K allows an authorized attacker to disclose information locally.4hCVE-2026-72774——
———n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type via an expression. Because the pre-execution permission check compares the unresolved expression instead of the resolved credential type, the ownership check is skipped and the credential is loaded at execution time, allowing the member to use or exfiltrate a credential they were not granted. Exploitation requires knowing the target credential's identifier.11hCVE-2026-72773——
———n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern can bypass the base-directory confinement check and expand to locations outside the configured directory, causing the tool to return the names and contents of arbitrary local files readable by the daemon's OS user. Any deployment where an actor can influence the tool's search input is affected.8hCVE-2026-72764——
———n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions (before 1.123.67, 2.31.5, and 2.32.1), a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting their confidentiality, integrity, or availability. This is a cross-user isolation break within a single n8n instance and does not constitute a sandbox escape or remote code execution. Only multi-user instances running the JS task runner with built-in or external modules enabled are affected.11hCVE-2026-72763——
———n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with Editor access to a shared workflow (when workflow sharing is enabled) who knows a target credential's ID can reference that credential in the inline JSON; it passes save-time and runtime validation and resolves in the parent workflow's project context, allowing the attacker to use or exfiltrate credentials they are not permitted to access.8hCVE-2026-72762——
———n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to write arbitrary files outside the node's working directory on the n8n instance.10hCVE-2026-72750——
———n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL query, that data is not parameterized, allowing SQL injection. The fix adds an optional 'Query Parameters' field to bind values via positional placeholders.13hCVE-2026-627477.8 HIG—
———Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.7hCVE-2026-627487.0 HIG—
———Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.4hCVE-2026-627497.0 HIG—
———Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.6hCVE-2026-627506.5 MED—
———Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network.4hCVE-2026-627517.8 HIG—
———Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally.6h