CVE Watch402,558 in full archive

Vulnerabilities exploitable today

402,558in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,756

New KEV · 24H0

Exploit Today ≥ 701,669

Distribution · last window

Critical
4,455
High
18,108
Medium
16,661
Low
1,668

Filters

Window

Severity

Flags

Vulnerabilities388,241–388,280 · 402,558

CVECVSSEPSSKEVRExploitTitleMod.

——1——CVE-2026-968087.4 HIG

1.7%

——1In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session's directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation.30d CVE-2025-71139—

1.7%

——1——CVE-2026-107738—

1.7%

——1SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ() narrows file-controlled unsigned string offsets from /#WINDOWS and /#IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /#STRINGS buffer, causing deterministic application termination. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.11d CVE-2026-20751—

1.7%

——1——CVE-2024-58059—

1.7%

——1——CVE-2026-251103.3 LOW

1.7%

——1in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.93d CVE-2026-170475.4 MED

1.7%

——1IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation.38d CVE-2025-20696—

1.7%

——1——CVE-2025-331775.5 MED

1.7%

——1NVIDIA Jetson Linux and IGX OS contain a vulnerability in NvMap, where improper tracking of memory allocations could allow a local attacker to cause memory overallocation. A successful exploitation of this vulnerability might lead to denial of service.6d CVE-2023-33113—

——1——CVE-2024-470917.8 HIG

1.7%

——1Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able to create a Windows service whose name matches 'MySQL' or 'MariaDB' (or with write access to a binary referenced by such a service) to execute arbitrary code in the context of the Checkmk agent service, which typically runs as SYSTEM.1d CVE-2026-641665.5 MED

1.7%

——1In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Check for NULL FF-A ID table while driver registration The bus match callback assumes that every FF-A driver provides an id_table and dereferences it unconditionally. Enforce that contract at registration time so a buggy client driver cannot crash the bus during match.73d CVE-2026-205184.4 MED

1.7%

——1In geniezone, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: ALPS10867524 / ALPS10876355; Issue ID: MSV-6674.26d CVE-2022-20431—

1.7%

——1——CVE-2023-52543—

1.7%

——1——CVE-2026-150595.5 MED

1.7%

——1Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.1d CVE-2021-39814—

1.7%

——1——CVE-2026-911423.6 LOW

1.7%

——1A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modification and disclosure of login records. On 32-bit systems, an integer overflow during session accounting allows the user's login process to read or overwrite the legacy log entries of other accounts.9d CVE-2025-675984.3 MED

1.7%

——1Cross-Site Request Forgery (CSRF) vulnerability in PSM Plugins SupportCandy supportcandy allows Cross Site Request Forgery.This issue affects SupportCandy: from n/a through <= 3.4.1.10d CVE-2022-20039—

1.7%

——1——CVE-2023-32449—

1.7%

——1——CVE-2026-1092495.5 MED

1.7%

——1FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it advances its parsing cursor without reducing the remaining length, letting the scan window exceed the decrypted ConnectionString2 buffer. Attackers can supply a crafted .msrcIncident invitation file and password that crash xfreerdp when opened, before any RDP connection.11d CVE-2021-0665—

1.7%

——1——CVE-2025-621904.3 MED

1.7%

——1Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link12d CVE-2025-59130—

1.7%

——1——CVE-2026-810494.4 MED

1.7%

——1Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Support for Integrity Check vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution.38d CVE-2023-46919—

——1——CVE-2026-493147.3 HIG

1.7%

——1OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability.46d CVE-2021-0902—

1.7%

——1——CVE-2026-434465.5 MED

1.7%

——1In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix runtime suspend deadlock when there is pending job The runtime suspend callback drains the running job workqueue before suspending the device. If a job is still executing and calls pm_runtime_resume_and_get(), it can deadlock with the runtime suspend path. Fix this by moving pm_runtime_resume_and_get() from the job execution routine to the job submission routine, ensuring the device is resumed before the job is queued and avoiding the deadlock during runtime suspend.10d CVE-2026-107736—

1.7%

——1SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-controlled PropertyTagOrientation size through GetPropertyItem() while supplying only a fixed 64-byte buf on the stack. Opening a crafted TIFF with enough EXIF Orientation values can cause attacker-selected bytes to overwrite stack control data, while tested builds terminate through the stack cookie check. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.16d