Vulnerabilities exploitable today
402,537in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,756
New KEV · 24H0
Exploit Today ≥ 701,669
Distribution · last window
- Critical4,455
- High18,105
- Medium16,660
- Low1,666
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-32449—1.7%
——1——CVE-2025-621904.3 MED1.7%
——1Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link12dCVE-2017-18672—1.7%
——1——CVE-2022-24928—1.7%
——1——CVE-2021-0900—1.7%
——1——CVE-2023-33113—1.7%
——1——CVE-2025-331775.5 MED1.7%
——1NVIDIA Jetson Linux and IGX OS contain a vulnerability in NvMap, where improper tracking of memory allocations could allow a local attacker to cause memory overallocation. A successful exploitation of this vulnerability might lead to denial of service.6dCVE-2025-20696—1.7%
——1——CVE-2024-470917.8 HIG1.7%
——1Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able to create a Windows service whose name matches 'MySQL' or 'MariaDB' (or with write access to a binary referenced by such a service) to execute arbitrary code in the context of the Checkmk agent service, which typically runs as SYSTEM.1dCVE-2025-0123—1.7%
——1——CVE-2023-33033—1.7%
——1——CVE-2026-805768.8 HIG1.7%
——1In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: reject oversized IBs with per-ring packet limits
On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through
to ib->length_dw without a limit, while ring_emit_ib() encodes length
into packet fields. Oversized values can corrupt adjacent control bits
and destabilize command submission.
Add a per-ring IB packet size limit helper and reject command
submissions exceeding the corresponding dword limit before IB
allocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE,
and apply the MM fallback limit for other ring types.
(cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)8dCVE-2021-0659—1.7%
——1——CVE-2024-25024—1.7%
——1——CVE-2022-20038—1.7%
——1——CVE-2025-63014—1.7%
——1——CVE-2024-47157—1.7%
——1——CVE-2023-33108—1.7%
——1——CVE-2022-35720—1.7%
——1——CVE-2025-675904.3 MED1.7%
——1Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Ultimate FAQ ultimate-faqs allows Cross Site Request Forgery.This issue affects Ultimate FAQ: from n/a through <= 2.4.3.17dCVE-2020-11277—1.7%
——1——CVE-2026-493147.3 HIG1.7%
——1OOB write vulnerability in the rendering and composition module.
Impact: Successful exploitation of this vulnerability may affect availability.46dCVE-2021-0902—1.7%
——1——CVE-2021-39620—1.7%
——1——CVE-2020-37223—1.7%
——1——CVE-2020-37231—1.7%
——1——CVE-2025-59130—1.7%
——1——CVE-2021-25462—1.7%
——1——CVE-2023-45780—1.7%
——1——CVE-2021-0442—1.7%
——1——CVE-2026-58894.3 MED1.7%
——1Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs via a brute-force attack. (Chromium security severity: Medium)96dCVE-2022-20036—1.7%
——1——CVE-2025-83056.5 MED1.7%
——1An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being printed in plaintext in Identity Agent for Terminal Services debug files.5dCVE-2021-0439—1.7%
——1——CVE-2021-0926—1.7%
——1——CVE-2022-20440—1.7%
——1——CVE-2021-0895—1.7%
——1——CVE-2026-168197.7 HIG1.7%
——1IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compromise data integrity due to a time-of-check time-of-use race condition.65dCVE-2021-0689—1.7%
——1——CVE-2021-22549—1.7%
——1——