Vulnerabilities exploitable today
377,415in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,716
New KEV · 24H3
Exploit Today ≥ 701,647
Distribution · last window
- Critical2,355
- High8,510
- Medium6,633
- Low715
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-240807.8 HIG0.0%
——0Memory Corruption when handling malformed request parameters in the fingerprint TA.43dCVE-2025-47404—0.0%
——0——CVE-2023-20750—0.0%
——0——CVE-2026-01584.0 MED0.0%
——0In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.2dCVE-2026-00543.3 LOW0.0%
——0In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.3dCVE-2021-25502—0.0%
——0——CVE-2023-20684—0.0%
——0——CVE-2024-43766—0.0%
——0——CVE-2026-0133—0.0%
——0——CVE-2025-66322—0.0%
——0——CVE-2026-286303.3 LOW0.0%
——0In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.3dCVE-2025-48641—0.0%
——0——CVE-2026-256006.4 MED0.0%
——0The PDBM application relies on a static, hard‑coded secret embedded
in the PDBM.exe executable. This secret is used by the application’s
encryption routines, including the function responsible for decrypting
credentials stored in the product’s configuration file. Because the
secret is constant across installations, any attacker with sufficient
local privileges can extract it from the binary. Once obtained, the secret allows the attacker to decrypt the stored
password and authenticate as the user defined in the configuration file.
In the affected version, this user account is configured with
administrative privileges, granting full access to PDBM’s management
interface and its underlying operational functions.59dCVE-2026-0150—0.0%
——0——CVE-2025-47374—0.0%
——0——CVE-2024-47025—0.0%
——0——CVE-2025-23364—0.0%
——0——CVE-2025-68969—0.0%
——0——CVE-2026-286007.8 HIG0.0%
——0In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.3dCVE-2026-286267.3 HIG0.0%
——0In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.3dCVE-2026-0057—0.0%
——0——CVE-2019-20775—0.0%
——0——CVE-2026-178726.1 MED0.0%
——0Cryptographic Flaw in WebAppInstalls in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)46dCVE-2026-16459—0.0%
——0Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations.23dCVE-2026-569585.5 MED0.0%
——0In gf_algo_get_cached_dump_data of gf_algo.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.2dCVE-2026-813306.5 MED0.0%
——0The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, and captured network traffic contains reconstructable JPEG or WEBP video frames transmitted over UDP. An attacker within local wireless range may capture and reconstruct the live video stream without transport encryption.8dCVE-2026-252597.8 HIG0.0%
——0Memory corruption while processing multiple IOCTL command for escape operations.58dCVE-2026-587447.8 HIG0.0%
——0In multiple locations, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.9hCVE-2023-20736—0.0%
——0——CVE-2025-22442—0.0%
——0——CVE-2026-286335.5 MED0.0%
——0In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.3dCVE-2023-20785—0.0%
——0——CVE-2026-21002—0.0%
——0——CVE-2026-2345—0.0%
——0——CVE-2025-48575—0.0%
——0——CVE-2026-169277.3 HIG0.0%
——0IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain root privileges due to a time-of-check to time-of-use (TOCTOU) race condition.25dCVE-2026-0153—0.0%
——0——CVE-2023-20620—0.0%
——0——CVE-2022-48451—0.0%
——0——CVE-2026-00163.3 LOW0.0%
——0In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.59d