CVE Watch403,583 in full archive

Vulnerabilities exploitable today

403,583in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,758

New KEV · 24H0

Exploit Today ≥ 701,691

Distribution · last window

Critical
5,587
High
21,596
Medium
20,043
Low
2,105

Filters

Window

Severity

Flags

Vulnerabilities383,601–383,640 · 403,583

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-250403.3 LOW

3.1%

——1A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects: - AOS-CX 10.14.xxxx : All patches - AOS-CX 10.15.xxxx : 10.15.1000 and below The vulnerability is specific to traffic originated by the CX 9300 switch platform and could allow an attacker to bypass ACL rules applied to routed ports on egress. As a result, port ACLs are not correctly enforced, which could lead to unauthorized traffic flow and violations of security policies. Egress VLAN ACLs and Routed VLAN ACLs are not affected by this vulnerability.35d CVE-2025-42927—

3.1%

——1——CVE-2025-71230—

3.1%

——1——CVE-2026-1106337.8 HIG

3.1%

——1MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.11d CVE-2026-40471—

3.1%

——1——CVE-2020-0417—

3.1%

——1——CVE-2023-537487.1 HIG

3.1%

——1In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup variable *nplanes is provided by user via system call argument. The possible value of q_data->fmt->num_planes is 1-3, while the value of *nplanes can be 1-8. The array access by index i can cause array out-of-bounds. Fix this bug by checking *nplanes against the array size.84d CVE-2025-20090—

——1Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.11d CVE-2026-475407.8 HIG

3.0%

——1NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an integer underflow. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.27d CVE-2025-49069—

3.0%

——1——CVE-2026-339203.5 LOW

3.0%

——1A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performed by the victim in this state is attributed to the attacker's account, compromising the integrity of the audit trail.13d CVE-2020-35555—

3.0%

——1——CVE-2026-23102—

3.0%

——1——CVE-2026-769613.5 LOW

3.0%

——1SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity. There is no impact on availability.48d CVE-2026-475137.8 HIG

3.0%

——1NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read from kernel heap memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.27d CVE-2018-25378—

3.0%

——1——CVE-2025-71153—

3.0%

——1——CVE-2026-913366.5 MED

3.0%

——1Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Solaris accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N).6d CVE-2025-41223—

3.0%

——1——CVE-2024-9203—

3.0%

——1——CVE-2026-475457.8 HIG

3.0%

——1NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.27d CVE-2026-446988.3 HIG

3.0%

——1Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app WebView window.externalApp on Android and webkit.messageHandlers.getExternalAuth (alongside revokeExternalAuth and externalBus) on iOS. Two flaws expose the bridge to all frames (including cross-origin iframes) and unsanitized interpolation of the JavaScript callback identifier allows a cross-origin iframe rendered inside the Companion app to execute arbitrary JavaScript in the Home Assistant frontend's main-frame origin and exfiltrate the signed-in user's access token. This vulnerability is fixed in 2026.4.1 for iOS and 2026.4.4 for Android.98d CVE-2019-20579—

3.0%

——1——CVE-2026-475567.8 HIG

3.0%

——1NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an integer overflow that leads to an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.27d CVE-2020-0285—

——1——CVE-2026-475707.8 HIG

3.0%

——1NVIDIA GPU Display Driver for Windows contains a vulnerability in the CUDA driver where an attacker could cause a library to be loaded from an uncontrolled search path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, data tampering, and denial of service.26d CVE-2017-18680—

——1——CVE-2025-361856.2 MED

3.0%

——1IBM Db2 12.1.0 through 12.1.2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.20d CVE-2026-1087232.5 LOW

3.0%

——1answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving symlinks. Attackers can ship a repository with a symlink pointing outside the checkout so am render embeds readable external files into generated HTML, disclosing them when shared.9d CVE-2023-28586—

3.0%

——1——