CVE Watch377,415 in full archive

Vulnerabilities exploitable today

377,415in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,716

New KEV · 24H3

Exploit Today ≥ 701,647

Distribution · last window

Critical
2,355
High
8,510
Medium
6,633
Low
715

Filters

Window

Severity

Flags

Vulnerabilities376,721–376,760 · 377,415

CVECVSSEPSSKEVRExploitTitleMod.

——0——CVE-2026-146814.2 MED

0.0%

——0Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.6 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.20d CVE-2026-00897.8 HIG

0.0%

——0In multiple functions of PackageInstallerService.java, there is a possible way to install unverified apps due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.58d CVE-2025-48608—

——0Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05.15d CVE-2026-286247.8 HIG

0.0%

——0In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.3d CVE-2026-286167.8 HIG

0.0%

——0In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.3d CVE-2025-66320—

0.0%

——0——CVE-2026-285823.3 LOW

0.0%

——0In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.3d CVE-2026-286077.8 HIG

0.0%

——0In multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.3d CVE-2026-00987.8 HIG

0.0%

——0In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.58d CVE-2026-419756.3 MED

0.0%

——0Permission management vulnerability in the network management module. Impact: Successful exploitation of this vulnerability may affect service integrity.58d CVE-2026-0125—

——0——CVE-2026-286147.8 HIG

0.0%

——0In onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.3d CVE-2026-240837.8 HIG

0.0%

——0Memory Corruption while processing IOCTL device driver requests with invalid arguments.43d CVE-2026-44509—

0.0%

——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43619. Reason: This candidate is a duplicate of CVE-2026-43619. Notes: All CVE users should reference CVE-2026-43619 instead of this candidate.59d CVE-2026-455193.3 LOW

0.0%

——0In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.8d CVE-2023-20686—

——0——CVE-2026-286117.8 HIG

0.0%

——0In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.3d CVE-2026-207572.5 LOW

0.0%

——0Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server. This issue affects Command Centre Server: 9.40 prior to vEL9.40.1976(MR1), 9.30 prior to vEL9.30.3382 (MR4), 9.20 prior to vEL9.20.3783 (MR6), 9.10 prior to vEL9.10.4647 (MR9), all versions of 9.00 and prior.31d CVE-2026-587736.7 MED

0.0%

——0In link_load_gnss_image of link_device.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.9h CVE-2026-16458—

0.0%

——0Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.0.0 and prior to 4.0.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations.23d CVE-2026-213667.8 HIG

0.0%

——0Memory corruption while processing a packet with a size close to the maximum allowed value.43d CVE-2026-286223.3 LOW

0.0%

——0In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.3d CVE-2023-20687—