Vulnerabilities exploitable today
363,686in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,671
New KEV · 24H0
Exploit Today ≥ 701,610
Distribution · last window
- Critical2,948
- High12,438
- Medium7,643
- Low714
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-51239——
——0Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.21dCVE-2026-51287——
——0Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.21dCVE-2026-15424——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.8dCVE-2026-23675——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.11dCVE-2025-47332—0.0%
——0——CVE-2021-47994——
——0Rejected reason: This CVE ID has been rejected.10dCVE-2026-15799——
——0Rejected reason: This is a duplicate.25dCVE-2026-61829——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61452. Reason: This candidate is a duplicate of CVE-2026-61452. Notes: All CVE users should reference CVE-2026-61452 instead of this candidate.37dCVE-2026-69124——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-67320. Reason: This candidate is a duplicate of CVE-2026-67320. Notes: All CVE users should reference CVE-2026-67320 instead of this candidate.14dCVE-2023-20914—0.0%
——0——CVE-2026-62172——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61436. Reason: This candidate is a duplicate of CVE-2026-61436. Notes: All CVE users should reference CVE-2026-61436 instead of this candidate.37dCVE-2026-49946——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.44dCVE-2026-16312——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.32dCVE-2026-61605——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-58655. Reason: This candidate is a duplicate of CVE-2026-58655. Notes: All CVE users should reference CVE-2026-58655 instead of this candidate.37dCVE-2026-29010——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.11dCVE-2025-66333—0.0%
——0——CVE-2026-62175——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-60091. Reason: This candidate is a duplicate of CVE-2026-60091. Notes: All CVE users should reference CVE-2026-60091 instead of this candidate.37dCVE-2026-22653——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.11dCVE-2026-58461——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.38dCVE-2025-15065—0.0%
——0——CVE-2023-20835—0.0%
——0——CVE-2026-51247——
——0Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.21dCVE-2026-467347.3 HIG0.0%
——0Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Certificate Validation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.42dCVE-2026-6890——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.21dCVE-2025-66332—0.0%
——0——CVE-2026-32835——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.16dCVE-2025-36916—0.0%
——0——CVE-2026-62165——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61446. Reason: This candidate is a duplicate of CVE-2026-61446. Notes: All CVE users should reference CVE-2026-61446 instead of this candidate.37dCVE-2026-10772——
——0Rejected reason: ** DUPLICATE ** This CVE Record has been rejected by the Zephyr Project CNA. CVE-2026-10772 was assigned to a vulnerability already covered by CVE-2026-2411, which was assigned earlier for the same defect: the Bluetooth GATT notify/indicate paths check the permissions of the Characteristic Declaration attribute rather than the Characteristic Value attribute, so the encryption/authentication requirements configured on the value are not enforced. Both identifiers describe the same root cause in subsys/bluetooth/host/gatt.c, fixed by the same commit (c3386f92fe81bd10dc23e6a115e6a80a7d863546). Use CVE-2026-2411 instead.20dCVE-2026-252607.8 HIG0.0%
——0Memory Corruption when accessing shared buffers without validation of concurrent user-mode input modifications.29dCVE-2026-16339——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.22dCVE-2025-66321—0.0%
——0——CVE-2026-32317—0.0%
——0——CVE-2026-28551—0.0%
——0——CVE-2023-7347——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.7dCVE-2026-18932——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6dCVE-2026-51386——
——0Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2026-46409. Reason: This record is a reservation duplicate of CVE-2026-46409. Notes: All CVE users should reference CVE-2026-46409 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.32dCVE-2026-213705.3 MED0.0%
——0Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values.45dCVE-2026-759168.6 HIG—
——0SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can set these metadata fields on a block can inject a self-firing payload (e.g. <img src=x onerror=...>) that executes automatically when a victim types '((' followed by a search term that surfaces the crafted block. Because SiYuan's Electron windows run with nodeIntegration enabled, contextIsolation disabled, and no CSP, the injected script gains require('child_process') access, allowing the XSS to escalate to arbitrary OS command execution.2dCVE-2026-762078.1 HIG—
——0phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access without second-factor verification.2d