Vulnerabilities exploitable today
401,677in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,666
Distribution · last window
- Critical3,400
- High15,532
- Medium14,795
- Low1,422
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-114113—1.1%
——0Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.2dCVE-2026-109984.0 MED1.1%
——0Out of bounds read in Media in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to perform an out of bounds memory read via malicious network traffic. (Chromium security severity: Medium)93dCVE-2025-121145.5 MED1.1%
——0Enabled serial console could potentially leak information that might help attacker to find vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.4dCVE-2025-68403—1.1%
——0An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system.
We have already fixed the vulnerability in the following version:
QuRouter 2.7.2.113 and later3dCVE-2026-437434.7 MED1.1%
——0A race condition was addressed with improved state handling. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, iOS 26.7 and iPadOS 26.7, macOS Tahoe 26.5.2, macOS Tahoe 26.7, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.38dCVE-2026-769574.9 MED1.1%
——0libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.45dCVE-2026-789362.9 LOW1.1%
——0Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium)53dCVE-2026-953162.9 LOW1.1%
——0Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. (Chromium security severity: Low)24dCVE-2026-16726—1.1%
——0Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 allows
attackers to stop Windows.35dCVE-2022-36841—1.1%
——0——CVE-2026-953584.4 MED1.1%
——0Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)22dCVE-2026-93323—1.1%
——0The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which interrupts other builds on the same instance. Fixed by rejecting such files above 16 MiB.17dCVE-2026-103438—1.1%
——0——CVE-2026-107733—1.1%
——0SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointer to RunWithExe(), which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal to SumatraPDF's under Windows UIPI, can dispatch CmdExec over DDE or WM_COPYDATA while no document tab is open, causing abrupt process termination and loss of unsaved state. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.9dCVE-2022-36860—1.1%
——0——CVE-2026-19915—1.1%
——0A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.55.10.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls.24dCVE-2025-21467—1.1%
——0——CVE-2023-35669—1.1%
——0——CVE-2026-789492.9 LOW1.1%
——0Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium)53dCVE-2024-51521—1.1%
——0——CVE-2022-21781—1.1%
——0——CVE-2026-252688.8 HIG1.1%
——0Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations.108dCVE-2026-103439—1.1%
——0——CVE-2022-21782—1.1%
——0——CVE-2023-21206—1.1%
——0——CVE-2022-36844—1.1%
——0——CVE-2022-20268—1.1%
——0——CVE-2024-20060—1.1%
——0——CVE-2021-0706—1.1%
——0——CVE-2022-21787—1.1%
——0——CVE-2026-208015.6 MED1.1%
——0Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrations allows unprivileged users with local network access to view live video streams.
This issue affects all versions of Gallagher NxWitness VMS integration prior to 9.10.017 and Gallagher Hanwha VMS integration prior to 9.10.025.67dCVE-2025-14759—1.1%
——0——CVE-2023-32878—1.1%
——0——CVE-2022-36855—1.1%
——0——CVE-2024-25027—1.1%
——0——CVE-2023-33896—1.1%
——0——CVE-2026-757827.8 HIG1.1%
——0IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.10dCVE-2022-36862—1.1%
——0——CVE-2016-200544.3 MED1.1%
——0Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.15dCVE-2025-486377.8 HIG1.1%
——0In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.16d