CVE Watch369,139 in full archive

Vulnerabilities exploitable today

369,139in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,694

New KEV · 24H0

Exploit Today ≥ 701,634

Distribution · last window

Critical
2,182
High
7,846
Medium
5,729
Low
553

Filters

Window

Severity

Flags

Vulnerabilities368,361–368,400 · 369,139

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-16552—

—

——0Rejected reason: The reported issue is invalid, as it requires root privileges to reproduce, and it is out of scope of the threat model of the affected component.44d CVE-2026-77812—

0.0%

——0DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user. * An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network * The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices. * The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely * The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed * A BLE sniffer and presence during one normal DJI Fly connection are needed Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600. Remediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading.12d CVE-2026-56875—

—

——0Rejected reason: reserved but not needed15d CVE-2023-45211—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9d CVE-2026-62177—

—

——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-60085. Reason: This candidate is a duplicate of CVE-2026-60085. Notes: All CVE users should reference CVE-2026-60085 instead of this candidate.52d CVE-2026-2345—

0.0%

——0——CVE-2026-6889—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.36d CVE-2026-6890—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.36d CVE-2026-29033—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.26d CVE-2026-29025—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.26d CVE-2025-30178—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused24d CVE-2023-36863—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9d CVE-2023-22328—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9d CVE-2023-38134—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9d CVE-2026-51299—

—

——0Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.36d CVE-2026-16312—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.47d CVE-2023-32287—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9d CVE-2023-38540—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9d CVE-2025-21473—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.14d CVE-2023-47176—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9d CVE-2023-46710—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9d CVE-2026-67188—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.38d CVE-2023-31201—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9d CVE-2023-43759—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9d CVE-2023-22343—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9d CVE-2023-34428—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9d CVE-2026-61605—

—

——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-58655. Reason: This candidate is a duplicate of CVE-2026-58655. Notes: All CVE users should reference CVE-2026-58655 instead of this candidate.52d CVE-2023-35125—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9d CVE-2026-167426.7 MED

0.0%

——0systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user4d CVE-2023-35761—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9d CVE-2026-73323—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.15d CVE-2026-69701—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.15d CVE-2026-73103—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.18d CVE-2026-56868—

—

——0Rejected reason: reserved but not needed18d CVE-2026-56869—

—

——0Rejected reason: reserved but not needed18d CVE-2023-34393—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9d CVE-2026-8281—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.52d CVE-2026-68574—

—

——0Rejected reason: Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked.36d