Vulnerabilities exploitable today
377,415in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,716
New KEV · 24H3
Exploit Today ≥ 701,647
Distribution · last window
- Critical2,355
- High8,510
- Medium6,633
- Low715
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-82514——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.10dCVE-2026-87730——
——0Rejected reason: this is rejected3dCVE-2026-68577——
——0Rejected reason: Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked.49dCVE-2026-51242——
——0Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.49dCVE-2026-51288——
——0Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.49dCVE-2026-64840——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.19dCVE-2025-66331—0.0%
——0——CVE-2026-57844——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.8dCVE-2023-36863——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused22dCVE-2026-53991——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.28dCVE-2026-3229—0.0%
——0——CVE-2026-799755.5 MED0.0%
——0Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to server-side request forgery.3dCVE-2026-14942——
——0Rejected reason: This CVE ID was assigned to a reported vulnerability in the Customer Reviews for WooCommerce WordPress plugin and was never published. The report was withdrawn: the precondition it depends on, an attacker obtaining a review form identifier belonging to a customer they do not already have access to, could not be demonstrated. No advisory was issued for this ID.21dCVE-2026-76069——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.28dCVE-2026-49946——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.72dCVE-2023-42767——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused22dCVE-2026-43636——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.63dCVE-2023-42777——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused22dCVE-2023-35125——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused22dCVE-2021-47988——
——0Rejected reason: This CVE ID has been rejected.38dCVE-2026-76830——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.25dCVE-2026-29012——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.39dCVE-2026-28533——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.39dCVE-2026-51250——
——0Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.49dCVE-2023-27381——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused22dCVE-2023-28721——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused22dCVE-2026-58212——
——0Rejected reason: Further research determined the issue is not a vulnerability based on CNA Rule 4.1.12 The act of updating Product dependencies MUST NOT be determined to be a Vulnerability, regardless of whether the dependencies have Vulnerabilities.72dCVE-2020-37264——
——0Rejected reason: This CVE ID has been rejected.38dCVE-2023-32630——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused22dCVE-2026-70624——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.42dCVE-2026-70623——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.42dCVE-2026-15424——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.37dCVE-2026-73323——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.28dCVE-2023-46710——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused22dCVE-2026-29030——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.39dCVE-2026-16339——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.51dCVE-2026-64844——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.19dCVE-2026-58125——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.71dCVE-2026-77812—0.0%
——0DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.
* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network
* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.
* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely
* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed
* A BLE sniffer and presence during one normal DJI Fly connection are needed
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading.26dCVE-2023-28403——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused22d