Vulnerabilities exploitable today
401,677in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,666
Distribution · last window
- Critical3,410
- High15,621
- Medium14,870
- Low1,427
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-20717—0.8%
——0——CVE-2022-33687—0.8%
——0——CVE-2023-21072—0.8%
——0——CVE-2024-20097—0.8%
——0——CVE-2022-32629—0.8%
——0——CVE-2022-33696—0.8%
——0——CVE-2026-0122—0.8%
——0——CVE-2024-39819—0.8%
——0——CVE-2025-0079—0.8%
——0——CVE-2022-32623—0.8%
——0——CVE-2026-587266.7 MED0.8%
——0In FsmReleaseKey of fsm.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.34dCVE-2022-33688—0.8%
——0——CVE-2024-49740—0.8%
——0——CVE-2022-21763—0.8%
——0——CVE-2024-20096—0.8%
——0——CVE-2022-33694—0.8%
——0——CVE-2025-54633—0.8%
——0——CVE-2025-23279—0.8%
——0——CVE-2026-1119226.3 MED0.8%
——0Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT to take over the logged-in user's account.3dCVE-2023-21073—0.8%
——0——CVE-2025-22425—0.8%
——0——CVE-2026-1040404.4 MED0.8%
——0A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population.6dCVE-2023-42720—0.8%
——0——CVE-2026-1138107.0 HIG0.8%
——0A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.
Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator.2dCVE-2023-40120—0.8%
——0——CVE-2023-20630—0.8%
——0——CVE-2026-800477.8 HIG0.8%
——0A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attacker‑controlled Python code from custom_generate/generate.py is copied into the user’s ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification.29dCVE-2023-21075—0.8%
——0——CVE-2023-33893—0.8%
——0——CVE-2025-54641—0.8%
——0——CVE-2023-33890—0.8%
——0——CVE-2023-33888—0.8%
——0——CVE-2026-568896.7 MED0.8%
——0In multiple locations, there is a possible permission bypass due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.31dCVE-2026-20905—0.8%
——0——CVE-2023-20966—0.8%
——0——CVE-2021-25476—0.8%
——0——CVE-2022-33698—0.8%
——0——CVE-2026-207755.3 MED0.8%
——0Uncaught exception for some Intel(R) TDX modules within Ring 0: Trust Domain may allow a denial of service. System software adversary with a privileged user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (high) impacts.52dCVE-2023-35677—0.8%
——0——CVE-2026-189947.1 HIG0.8%
——0A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application.41d