Vulnerabilities exploitable today
401,677in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,666
Distribution · last window
- Critical3,400
- High15,531
- Medium14,790
- Low1,422
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-188573.4 LOW1.1%
——0IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to be read, resulting in a confidentiality and availability impact to the managed system.29dCVE-2026-261037.1 HIG1.1%
——0A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.100dCVE-2026-110727.8 HIG1.1%
——0Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. (Chromium security severity: Medium)92dCVE-2023-21252—1.1%
——0——CVE-2026-114113—1.1%
——0Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.2dCVE-2026-114593.3 LOW1.1%
——0A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. Impacted is an unknown function in the library saappctl.sys of the component IOCTL Handler. The manipulation leads to information disclosure. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used.92dCVE-2025-62624—1.1%
——0——CVE-2024-56188—1.1%
——0——CVE-2025-486387.8 HIG1.1%
——0In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.16dCVE-2024-20060—1.1%
——0——CVE-2021-0706—1.1%
——0——CVE-2026-252688.8 HIG1.1%
——0Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations.108dCVE-2023-21206—1.1%
——0——CVE-2026-103439—1.1%
——0——CVE-2022-20268—1.1%
——0——CVE-2022-36844—1.1%
——0——CVE-2022-21782—1.1%
——0——CVE-2023-20923—1.1%
——0——CVE-2026-107733—1.1%
——0SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointer to RunWithExe(), which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal to SumatraPDF's under Windows UIPI, can dispatch CmdExec over DDE or WM_COPYDATA while no document tab is open, causing abrupt process termination and loss of unsaved state. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.9dCVE-2026-19915—1.1%
——0A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.55.10.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls.24dCVE-2022-36846—1.1%
——0——CVE-2020-0373—1.1%
——0——CVE-2026-436904.7 MED1.1%
——0A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A local user may be able to read kernel memory.36dCVE-2025-27700—1.1%
——0——CVE-2024-1721—1.1%
——0——CVE-2022-26454—1.1%
——0——CVE-2026-953584.4 MED1.1%
——0Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)22dCVE-2026-16726—1.1%
——0Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 allows
attackers to stop Windows.35dCVE-2022-36841—1.1%
——0——CVE-2026-41702—1.1%
——0——CVE-2023-48421—1.1%
——0——CVE-2025-38223—1.1%
——0——CVE-2026-103438—1.1%
——0——CVE-2026-437434.7 MED1.1%
——0A race condition was addressed with improved state handling. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, iOS 26.7 and iPadOS 26.7, macOS Tahoe 26.5.2, macOS Tahoe 26.7, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.39dCVE-2026-93323—1.1%
——0The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which interrupts other builds on the same instance. Fixed by rejecting such files above 16 MiB.17dCVE-2026-769574.9 MED1.1%
——0libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.45dCVE-2026-953162.9 LOW1.1%
——0Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. (Chromium security severity: Low)24dCVE-2025-68403—1.1%
——0An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system.
We have already fixed the vulnerability in the following version:
QuRouter 2.7.2.113 and later3dCVE-2026-109984.0 MED1.1%
——0Out of bounds read in Media in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to perform an out of bounds memory read via malicious network traffic. (Chromium security severity: Medium)93dCVE-2026-789362.9 LOW1.1%
——0Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium)53d