Vulnerabilities exploitable today
401,677in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,666
Distribution · last window
- Critical3,410
- High15,621
- Medium14,870
- Low1,427
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2022-32623—0.8%
——0——CVE-2023-42728—0.8%
——0——CVE-2023-20630—0.8%
——0——CVE-2026-800477.8 HIG0.8%
——0A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attacker‑controlled Python code from custom_generate/generate.py is copied into the user’s ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification.29dCVE-2025-54641—0.8%
——0——CVE-2023-21075—0.8%
——0——CVE-2023-42719—0.8%
——0——CVE-2025-0079—0.8%
——0——CVE-2025-48522—0.8%
——0——CVE-2023-21079—0.8%
——0——CVE-2024-39819—0.8%
——0——CVE-2023-20947—0.8%
——0——CVE-2023-42721—0.8%
——0——CVE-2023-21078—0.8%
——0——CVE-2022-33696—0.8%
——0——CVE-2025-0044—0.8%
——0——CVE-2022-48462—0.8%
——0——CVE-2026-568896.7 MED0.8%
——0In multiple locations, there is a possible permission bypass due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.31dCVE-2026-20905—0.8%
——0——CVE-2023-33890—0.8%
——0——CVE-2023-33888—0.8%
——0——CVE-2026-0314—0.8%
——0A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition.
The GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome OS is not affected by this vulnerability.7dCVE-2022-267587.1 HIG0.8%
——0A malicious application may cause unexpected changes in memory shared between processes. A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.4.91dCVE-2025-22425—0.8%
——0——CVE-2023-33884—0.8%
——0——CVE-2026-918008.8 HIG0.8%
——0A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges.7dCVE-2022-33697—0.8%
——0——CVE-2024-49506—0.8%
——0——CVE-2026-189947.1 HIG0.8%
——0A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application.41dCVE-2023-40120—0.8%
——0——CVE-2026-159615.2 MED0.8%
——0IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 IBM PowerVM could allow a local attacker to obtain sensitive information or cause a denial of service due to improper control of format strings.58dCVE-2026-1138107.0 HIG0.8%
——0A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.
Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator.2dCVE-2023-42720—0.8%
——0——CVE-2021-25476—0.8%
——0——CVE-2026-207755.3 MED0.8%
——0Uncaught exception for some Intel(R) TDX modules within Ring 0: Trust Domain may allow a denial of service. System software adversary with a privileged user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (high) impacts.52dCVE-2023-35677—0.8%
——0——CVE-2022-33698—0.8%
——0——CVE-2026-50606—0.8%
——0A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions.34dCVE-2022-21763—0.8%
——0——CVE-2023-21077—0.8%
——0——