Vulnerabilities exploitable today
401,677in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,666
Distribution · last window
- Critical3,401
- High15,534
- Medium14,799
- Low1,422
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-38414—0.8%
——0——CVE-2023-20613—0.8%
——0——CVE-2026-868197.1 HIG0.8%
——0Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement (application identifier and Team ID). A local, authenticated user can execute code within the vendor-signed process, satisfy the helper's client check, and cause the helper to execute a script with root privileges. Fixed in 17.0.38dCVE-2022-20032—0.8%
——0——CVE-2023-20845—0.8%
——0——CVE-2022-21749—0.8%
——0——CVE-2022-20287—0.8%
——0——CVE-2022-23429—0.8%
——0——CVE-2026-0021—0.8%
——0——CVE-2026-1015457.0 HIG0.8%
——0Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Inventory Management executes to compromise Oracle Inventory Management. Successful attacks of this vulnerability can result in takeover of Oracle Inventory Management. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).2dCVE-2026-00755.9 MED0.8%
——0In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.93dCVE-2026-1015447.0 HIG0.8%
——0Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Payroll executes to compromise Oracle Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).2dCVE-2026-22702—0.8%
——0——CVE-2025-27050—0.8%
——0——CVE-2023-20612—0.8%
——0——CVE-2024-38411—0.8%
——0——CVE-2025-22404—0.8%
——0——CVE-2025-27047—0.8%
——0——CVE-2022-20289—0.8%
——0——CVE-2022-20291—0.8%
——0——CVE-2025-22405—0.8%
——0——CVE-2026-211046.7 MED0.8%
——0Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code.42dCVE-2023-20616—0.8%
——0——CVE-2026-23186—0.8%
——0——CVE-2022-20272—0.8%
——0——CVE-2026-790578.1 HIG0.8%
——0Race condition in Start in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: Medium)57dCVE-2024-43082—0.8%
——0——CVE-2026-22003—0.8%
——0——CVE-2026-1052714.3 MED0.8%
——0"ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtain the password of a user of the affected application.7dCVE-2024-56193—0.8%
——0——CVE-2025-27058—0.8%
——0——CVE-2025-27046—0.8%
——0——CVE-2026-7994—0.8%
——0——CVE-2026-20782—0.8%
——0——CVE-2026-704145.5 MED0.8%
——0Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.9dCVE-2023-42735—0.8%
——0——CVE-2023-44129—0.8%
——0——CVE-2022-30729—0.8%
——0——CVE-2026-463025.5 MED0.8%
——0In the Linux kernel, the following vulnerability has been resolved:
selinux: allow multiple opens of /sys/fs/selinux/policy
Currently there can only be a single open of /sys/fs/selinux/policy at
any time. This allows any process to block any other process from
reading the kernel policy. The original motivation seems to have been
a mix of preventing an inconsistent view of the policy size and
preventing userspace from allocating kernel memory without bound, but
this is arguably equally bad. Eliminate the policy_opened flag and
shrink the critical section that the policy mutex is held. While we
are making changes here, drop a couple of extraneous BUG_ONs.92dCVE-2026-286127.8 HIG0.8%
——0In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.37d