CVE Watch361,121 in full archive

Vulnerabilities exploitable today

361,121in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,666

New KEV · 24H0

Exploit Today ≥ 701,607

Distribution · last window

Critical
2,674
High
11,553
Medium
7,181
Low
660

Filters

Window

Severity

Flags

Vulnerabilities360,841–360,880 · 361,121

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-40512—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.8d CVE-2026-28534—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.8d CVE-2026-35006—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.8d CVE-2026-34423—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.8d CVE-2026-35005—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.8d CVE-2026-50268—

0.0%

——0——CVE-2026-22658—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.8d CVE-2020-37260—

—

——0Rejected reason: This CVE ID has been rejected.7d CVE-2021-47994—

—

——0Rejected reason: This CVE ID has been rejected.7d CVE-2021-47988—

—

——0Rejected reason: This CVE ID has been rejected.7d CVE-2025-596106.4 MED

0.0%

——0Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.27d CVE-2020-37265—

—

——0Rejected reason: This CVE ID has been rejected.7d CVE-2020-37263—

—

——0Rejected reason: This CVE ID has been rejected.7d CVE-2026-51280—

—

——0Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.18d CVE-2026-18060—

—

——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.20d CVE-2020-37261—

—

——0Rejected reason: This CVE ID has been rejected.7d CVE-2026-51262—

—

——0Rejected reason: This CVE ID has been rejected.7d CVE-2020-37258—

—

——0Rejected reason: This CVE ID has been rejected.7d CVE-2026-14170—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.22d CVE-2020-37257—

—

——0Rejected reason: This CVE ID has been rejected.7d CVE-2026-213695.3 MED

0.0%

——0Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification.42d CVE-2023-54374—

—

——0Rejected reason: This CVE ID has been rejected.7d CVE-2026-68577—

—

——0Rejected reason: Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked.19d CVE-2026-65351—

—

——0This issue was addressed through improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.1d CVE-2026-67854—

—

——0SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code1d CVE-2026-65349—

—

——0An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may be able to cause unexpected system termination or read kernel memory.1d CVE-2026-65347—

—

——0The issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing an image may lead to a denial-of-service.1d CVE-2026-653468.8 HIG

—

——0An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing an image may lead to arbitrary code execution.15h CVE-2026-65343—

—

——0A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. A remote attacker may be able to cause unexpected system termination.1d CVE-2026-691466.5 MED

—

——0MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user's run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0.1d CVE-2026-756279.8 CRI

—

——0Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, gaining control over SSH access to the managed fleet.15h CVE-2026-757733.7 LOW

—

——0A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. Upgrading to version 0.33.0 is sufficient to fix this issue. The patch is identified as f7d042971d0d2bcc7119654830cf1eb93eabbf24. It is advisable to upgrade the affected component.15h CVE-2026-691487.1 HIG

—

——0MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a run_id or model_id after _validate_source_run() or _validate_source_model() in mlflow/server/handlers.py verifies only path containment, allowing authenticated users to create a model version that references another user's artifact directory and read files through GET /model-versions/get-artifact without the required READ permission. This issue is fixed in version 3.15.0.1d CVE-2026-714249.6 CRI

—

——0Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info in backend/onyx/server/features/mcp/api.py copy per-user tokens into a shared admin MCPConnectionConfig row and _db_mcp_server_to_api_mcp_server returns that row through auth_template.headers to any BASIC_ACCESS user. This issue is fixed in versions 3.1.10, 3.2.14, and 4.0.0.1d CVE-2026-65341—

—

——0The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to memory corruption.1d CVE-2026-750774.3 MED

—

——0A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such manipulation of the argument course leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.1d CVE-2026-754827.5 HIG

—

——0SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory ('..') references, bypassing the built-in path sanitization. The server binds all interfaces (0.0.0.0), applies wildcard CORS, and requires no authentication. An unauthenticated network client (or a malicious web page via CORS) can use path traversal sequences to read files outside the intended directory. Because the read sink parses targets as trajectory JSON, disclosure is constrained to JSON files shaped like a trajectory, which can contain repository contents, command output, and secrets/API keys.1d CVE-2026-98596.5 MED

—

——0Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request. Mattermost Advisory ID: MMSA-2026-006861d CVE-2026-196085.3 MED

—

——0A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.15h