CVE Watch366,545 in full archive

Vulnerabilities exploitable today

366,545in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,685

New KEV · 24H0

Exploit Today ≥ 701,629

Distribution · last window

Critical
2,416
High
10,370
Medium
5,288
Low
512

Filters

Window

Severity

Flags

Vulnerabilities366,281–366,320 · 366,545

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-80611—

—

——0In the Linux kernel, the following vulnerability has been resolved: ACPI: processor_idle: Mark LPI enter functions as __cpuidle When function tracing or Kprobes is enabled, entering an ACPI Low Power Idle (LPI) state triggers the following RCU splat: RCU not on for: acpi_idle_lpi_enter+0x4/0xd8 WARNING: CPU: 8 PID: 0 at include/linux/trace_recursion.h:162 function_trace_call+0x1e8/0x228 The acpi_idle_lpi_enter() function is invoked within the cpuidle path after RCU has already been disabled for the current local CPU. Consequently, ftrace's function_trace_call() expects RCU to be actively watching before recording trace data, emitting a warning if it is not. Fix this by annotating acpi_idle_lpi_enter(), the generic __weak stub, and the RISC-V implementation of acpi_processor_ffh_lpi_enter() with __cpuidle. This moves these functions into the '.cpuidle.text' section, implicitly disabling ftrace instrumentation (notrace) along this sensitive path and preventing trace-induced RCU warnings during idle entry.10h CVE-2026-80613—

—

——0In the Linux kernel, the following vulnerability has been resolved: veth: fix NAPI leak in XDP enable error path During XDP enablement in veth, if xdp_rxq_info_reg() or xdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes. However, the rollback loop: for (i--; i >= start; i--) { decrements the loop index 'i' before the first iteration. This correctly skips unregistering the rxq for the failed index 'i' (as registration failed or was already cleaned up), but it also erroneously skips calling netif_napi_deli() for rq[i].xdp_napi. Since netif_napi_add() was already called for index 'i', this leaves a dangling napi_struct in the device's napi_list. When the veth device is later destroyed, the freed queue memory (which contains the leaked NAPI structure) can be reused. The subsequent device teardown iterates the NAPI list and corrupts the reallocated memory, leading to UAF. Fix this by explicitly deleting the NAPI association for the failed index 'i' before rolling back the successfully configured queues.10h CVE-2026-80614—

—

——0In the Linux kernel, the following vulnerability has been resolved: net: emac: Fix NULL pointer dereference in emac_probe Move devm_request_irq() after devm_platform_ioremap_resource() so that dev->emacp is mapped before the interrupt handler can fire. An early interrupt hitting emac_irq() would dereference the NULL dev->emacp and crash. Also remove redundant error message. devm_platform_ioremap_resource() already returns an error message with dev_err_probe().10h CVE-2026-758148.8 HIG

—

——0The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of device availability.18h CVE-2026-80615—

—

——0In the Linux kernel, the following vulnerability has been resolved: net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone kmalloc_flex() in metadata_dst_alloc() sets __counted_by for the structure to the options_len, which is then initialized to zero. Later, we're initializing the structure by copying the tunnel info together with the options, and this triggers a warning for a potential memcpy overflow, since the compiler estimates that the options can't fit into the structure, even though the memory for them is actually allocated. memcpy: detected buffer overflow: 104 byte write of buffer size 96 WARNING: CPU: X PID: Y at lib/string_helpers.c:1036 __fortify_report skb_tunnel_info_unclone+0x179/0x190 geneve_xmit+0x7fe/0xe00 The issue is triggered when built with clang and source fortification. Fix that by doing the copy in two stages: first - the main data with the options_len, then the options. This way the correct length should be known at the time of the copy. It would be better if the options_len never changed after allocation, but the allocation code is a little separate from the initialization and it would be awkward and potentially dangerous to return a struct with options_len set to a non-zero value from the metadata_dst_alloc(). Another option would be to use ip_tunnel_info_opts_set(), but it is doing too many unnecessary operations for the use case here.10h CVE-2026-487912.0 LOW

0.0%

——0sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verification spec. The old sigstore-conformance test for this check was built incorrectly. This vulnerability impacts only users verifying bundles with `dev.sigstore:sigstore-java:2.0.0`. Older versions are not affected; it is fixed in `dev.sigstore:sigstore-java:2.1.0` A malicious actor may exploit this if they were able to access a users system and exfiltrate the temporary private key used during signing and then reuse an old fulcio certificate later without requiring direct access to the user's credentials. Users may protect themselves by re-verifying their artifacts using the newest sigstore-java or another current sigstore client. Transparency logs may also be audited for unauthorized signatures for a suspected reused identity.15d CVE-2020-37260—

—

——0Rejected reason: This CVE ID has been rejected.17d CVE-2026-51229—

—

——0Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.28d CVE-2026-51257—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.51d CVE-2026-51289—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.18d CVE-2026-23765—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.18d CVE-2026-51262—

—

——0Rejected reason: This CVE ID has been rejected.17d CVE-2026-67619—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.7d CVE-2026-28539—

0.0%

——0——CVE-2026-22658—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.18d CVE-2026-19562—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.9d CVE-2026-71982—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.4d CVE-2026-19563—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.9d CVE-2025-30178—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused16d CVE-2026-68769—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6d CVE-2026-22653—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.18d CVE-2026-46536—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.8d CVE-2026-56875—

—

——0Rejected reason: reserved but not needed7d CVE-2026-35026—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.18d CVE-2026-73107—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.14d CVE-2025-25275—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused16d CVE-2026-51240—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.42d CVE-2022-50974—

—

——0Rejected reason: This CVE ID has been rejected.17d CVE-2026-51286—

—

——0Rejected reason: This CVE ID has been rejected.17d CVE-2025-32087—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused16d CVE-2026-22654—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.18d CVE-2026-22655—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.18d CVE-2023-54377—

—

——0Rejected reason: Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE.23d CVE-2025-32084—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused16d