Vulnerabilities exploitable today
404,880in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,760
New KEV · 24H0
Exploit Today ≥ 701,693
Distribution · last window
- Critical5,622
- High21,796
- Medium20,177
- Low2,113
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2020-36937—3.4%
——1——CVE-2026-964235.5 MED3.4%
——1X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service15dCVE-2025-25201—3.4%
——1——CVE-2025-62123—3.4%
——1——CVE-2026-407864.3 MED3.4%
——1Missing Authorization vulnerability in Long Watch Studio MyRewards woorewards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyRewards: from n/a through <= 5.7.3.2dCVE-2026-24875—3.4%
——1——CVE-2026-24873—3.4%
——1——CVE-2026-85793.1 LOW3.4%
——1Insufficient validation of untrusted input in Skia in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted print file. (Chromium security severity: Medium)3dCVE-2020-11173—3.4%
——1——CVE-2025-611567.8 HIG3.4%
——1Incorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows attackers to escalate privileges and execute arbitrary commands via an insecure IOCTL.9dCVE-2021-0602—3.4%
——1——CVE-2025-38268—3.4%
——1——CVE-2026-0312—3.4%
——1Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem.13dCVE-2025-36609—3.4%
——1——CVE-2024-22385—3.4%
——1——CVE-2023-20926—3.4%
——1——CVE-2023-53020—3.4%
——1——CVE-2025-38388—3.4%
——1——CVE-2026-348485.4 MED3.4%
——1hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability in the team member overflow tooltip via display name. This issue has been patched in version 2026.3.0.96dCVE-2026-341555.3 MED3.4%
——1RAUC controls the update process on embedded Linux systems. Prior to version 1.15.2, RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB cause an integer overflow which results in a signature which covers only the first few bytes of the payload. Given such a bundle with a legitimate signature, an attacker can modify the part of the payload which is not covered by the signature. This issue has been patched in version 1.15.2.96dCVE-2025-20951—3.4%
——1——CVE-2024-43862—3.4%
——1——CVE-2020-0311—3.4%
——1——CVE-2025-305066.7 MED3.4%
——1Uncontrolled search path for some Intel Driver and Support Assistant before version 25.2 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.10dCVE-2024-36970—3.4%
——1——CVE-2025-1984—3.4%
——1——CVE-2025-414214.7 MED3.4%
——1Improper handling of symbolic links in the TeamViewer Full Client and Host for Windows — in versions prior to 15.70 of TeamViewer Remote and Tensor — allows an attacker with local, unprivileged access to a device lacking adequate malware protection to escalate privileges by spoofing the update file path. This may result in unauthorized access to sensitive information.10dCVE-2026-46205—3.4%
——1——CVE-2023-40083—3.4%
——1——CVE-2020-0312—3.4%
——1——CVE-2023-47193—3.4%
——1——CVE-2025-21089—3.4%
——1——CVE-2026-185084.4 MED3.4%
——1A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.36dCVE-2024-54175—3.4%
——1——CVE-2024-54170—3.4%
——1——CVE-2026-30292—3.4%
——1——CVE-2026-864695.3 MED3.4%
——1A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file.50dCVE-2026-156815.5 MED3.4%
——1AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of screen recording files. By creating a junction, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-26591.106dCVE-2025-21998—3.4%
——1——CVE-2025-57797—3.4%
——1——