Vulnerabilities exploitable today
401,677in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,666
Distribution · last window
- Critical3,401
- High15,534
- Medium14,799
- Low1,422
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-767326.4 MED0.9%
——0A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges if certain preconditions are met outside of the attacker's control.22dCVE-2026-286587.8 HIG0.9%
——0In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.37dCVE-2020-16235—0.9%
——0——CVE-2026-58068—0.9%
——0——CVE-2023-21642—0.9%
——0——CVE-2026-474977.8 HIG0.9%
——0NVIDIA Virtual GPU Manager contains a vulnerability in the GPU System Processor (GSP) tracing component where a guest VM user may cause improper access by sending crafted data through a shared buffer. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.22dCVE-2023-21673—0.9%
——0——CVE-2026-20771—0.9%
——0——CVE-2024-20052—0.9%
——0——CVE-2024-7402—0.9%
——0——CVE-2020-0199—0.9%
——0——CVE-2023-21338—0.9%
——0——CVE-2026-0428—0.9%
——0——CVE-2023-20802—0.9%
——0——CVE-2026-286397.8 HIG0.9%
——0In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.37dCVE-2021-25428—0.9%
——0——CVE-2024-583837.3 HIG0.9%
——0Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable (the default on Debian 12), any unprivileged local user able to execute commands or code on the host — including virtual users without SSH access who can upload PHP/CGI scripts — can read the file and obtain the Froxlor database credentials. Database access can then be leveraged to alter an administrator's password hash and TOTP seed, log in as a Froxlor administrator, and ultimately gain root privileges. Only instances configured to use pure-ftpd are affected.14dCVE-2026-286647.8 HIG0.9%
——0In WriteImageToDisk of runtime_image.cc, there is a possible file tampering due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.29dCVE-2026-286687.8 HIG0.9%
——0In LimitRealloc of malloc_limit.cpp, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.29dCVE-2025-48521—0.9%
——0——CVE-2026-866114.3 MED0.9%
——0The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its unauthenticated maintenance endpoint.1dCVE-2023-24844—0.9%
——0——CVE-2026-11958—0.9%
——0——CVE-2024-45004—0.9%
——0——CVE-2026-105845.9 MED0.9%
——0Proxy server in Graph Explorer before 3.0.1 falls back to HTTP when certificate files are missing, which might allow remote threat actors to obtain sensitive information via interception of requests intended to be sent over HTTPS.
To remediate this issue, users should upgrade to Graph Explorer v3.0.1 or later.92dCVE-2026-467326.7 MED0.9%
——0Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain a Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.104dCVE-2025-41259—0.9%
——0SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to root or install untrusted contents using a signed update.92dCVE-2024-20050—0.9%
——0——CVE-2023-21093—0.9%
——0——CVE-2026-00496.2 MED0.9%
——0In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.90dCVE-2025-53696—0.9%
——0——CVE-2024-33061—0.9%
——0——CVE-2022-24929—0.8%
——0——CVE-2025-22406—0.8%
——0——CVE-2026-419855.1 MED0.8%
——0UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service integrity.92dCVE-2022-20277—0.8%
——0——CVE-2024-43063—0.8%
——0——CVE-2022-21748—0.8%
——0——CVE-2023-20614—0.8%
——0——CVE-2024-31127—0.8%
——0——