Vulnerabilities exploitable today
377,415in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,716
New KEV · 24H3
Exploit Today ≥ 701,647
Distribution · last window
- Critical2,355
- High8,510
- Medium6,633
- Low715
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-20429—0.1%
——0——CVE-2026-240766.7 MED0.1%
——0Memory Corruption when processing registry values with incorrect types using a direct query method.43dCVE-2026-0152—0.1%
——0——CVE-2026-286137.3 HIG0.1%
——0In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.3dCVE-2025-471475.7 MED0.1%
——0Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in Operator's mobile device to extract the session token and exploit access for a limited duration.
This issue affects Command Centre Mobile Client versions prior to 9.40.123.35dCVE-2025-48560—0.1%
——0——CVE-2025-58316—0.1%
——0——CVE-2026-50606—0.1%
——0A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions.6hCVE-2024-49742—0.1%
——0——CVE-2026-286027.8 HIG0.1%
——0In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there is a possible mult-iuser isolation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.3dCVE-2025-47357—0.1%
——0——CVE-2026-552903.3 LOW0.1%
——0In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.8dCVE-2026-12374—0.1%
——0Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller verification and a symlink swap during package installation.78dCVE-2024-49735—0.1%
——0——CVE-2026-588747.8 HIG0.1%
——0In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.10dCVE-2026-455287.3 HIG0.1%
——0In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.8dCVE-2025-36889—0.1%
——0——CVE-2026-419855.1 MED0.1%
——0UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service integrity.58dCVE-2026-00937.8 HIG0.1%
——0In multiple locations, there is a possible misleading UI due to obfuscation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.58dCVE-2026-00745.5 MED0.1%
——0In getPreferredSize of LauncherProcessImageListener.kt, there is a possible denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.59dCVE-2024-9858—0.1%
——0——CVE-2026-815234.4 MED0.1%
——0A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.1dCVE-2026-240888.2 HIG0.1%
——0Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader.58dCVE-2023-6728—0.1%
——0——CVE-2026-868197.1 HIG0.1%
——0Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement (application identifier and Team ID). A local, authenticated user can execute code within the vendor-signed process, satisfy the helper's client check, and cause the helper to execute a script with root privileges. Fixed in 17.0.4dCVE-2025-47373—0.1%
——0——CVE-2026-800585.5 MED0.1%
——0Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Cleartext Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.3dCVE-2025-36921—0.1%
——0——CVE-2025-47378—0.1%
——0——CVE-2025-15548—0.1%
——0——CVE-2026-00795.5 MED0.1%
——0In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.60dCVE-2026-24413—0.1%
——0——CVE-2024-47029—0.1%
——0——CVE-2026-75946—0.1%
——0A potential security vulnerability has been identified in the OMEN Gaming Hub for versions prior to 1101.2608.0.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls.18dCVE-2026-00367.8 HIG0.1%
——0In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.59dCVE-2026-185674.4 MED0.1%
——0IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory.10dCVE-2026-00997.8 HIG0.1%
——0In onNullBinding of HostEmulationManager.java, there is a possible way to launch an activity from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.58dCVE-2026-0131—0.1%
——0——CVE-2026-0143—0.1%
——0——CVE-2024-49724—0.1%
——0——