CVE Watch401,677 in full archive

Vulnerabilities exploitable today

401,677in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,754

New KEV · 24H0

Exploit Today ≥ 701,666

Distribution · last window

Critical
3,464
High
15,835
Medium
14,996
Low
1,476

Filters

Window

Severity

Flags

Vulnerabilities391,201–391,240 · 401,677

CVECVSSEPSSKEVRExploitTitleMod.

——0——CVE-2025-369347.4 HIG

0.7%

——0In bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15d CVE-2026-41568—

0.7%

——0——CVE-2026-755734.4 MED

0.7%

——0In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclosed password to access the associated TLS client key.29d CVE-2023-35654—

0.7%

——0——CVE-2025-526083.1 LOW

0.7%

——0HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cookie attributes, including Secure and SameSite. And also path is set to root.92d CVE-2025-53176—

0.7%

——0——CVE-2025-47904—

0.7%

——0——CVE-2025-516195.5 MED

0.7%

——0A vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) thru 1.4.0 allows local unprivileged users to cause a denial-of-service (BSOD) condition on Windows systems. The driver exposes an IOCTL interface (0x81772008) that accepts user-controlled input without validating pointers before passing them to kernel APIs. Specifically, it dereferences a user-supplied pointer and uses the resulting value in a call to ExSetTimerResolution, leading to an arbitrary kernel memory access. Exploiting this flaw results in a system crash.3d CVE-2023-21236—

——0——CVE-2026-232757.8 HIG

0.7%

——0In the Linux kernel, the following vulnerability has been resolved: io_uring: ensure ctx->rings is stable for task work flags manipulation If DEFER_TASKRUN | SETUP_TASKRUN is used and task work is added while the ring is being resized, it's possible for the OR'ing of IORING_SQ_TASKRUN to happen in the small window of swapping into the new rings and the old rings being freed. Prevent this by adding a 2nd ->rings pointer, ->rings_rcu, which is protected by RCU. The task work flags manipulation is inside RCU already, and if the resize ring freeing is done post an RCU synchronize, then there's no need to add locking to the fast path of task work additions. Note: this is only done for DEFER_TASKRUN, as that's the only setup mode that supports ring resizing. If this ever changes, then they too need to use the io_ctx_mark_taskrun() helper.3d CVE-2026-569076.7 MED

0.7%

——0In VPU, there is a possible shared memory overwrite due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.31d CVE-2017-11044—

0.7%

——0——CVE-2026-1020065.5 MED

0.7%

——0In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.0923d CVE-2023-21222—

0.7%

——0——CVE-2026-569726.7 MED

0.7%

——0In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.34d CVE-2025-22430—

0.7%

——0——CVE-2026-568886.2 MED

0.7%

——0In multiple locations, there is a possible permission bypass due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.31d CVE-2025-473897.8 HIG

0.7%

——0Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.15d CVE-2026-461594.7 MED

0.7%

——0In the Linux kernel, the following vulnerability has been resolved: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak btrfs_ioctl_space_info() has a TOCTOU race between two passes over the block group RAID type lists. The first pass counts entries to determine the allocation size, then the second pass fills the buffer. The groups_sem rwlock is released between passes, allowing concurrent block group removal to reduce the entry count. When the second pass fills fewer entries than the first pass counted, copy_to_user() copies the full alloc_size bytes including trailing uninitialized kmalloc bytes to userspace. Fix by copying only total_spaces entries (the actually-filled count from the second pass) instead of alloc_size bytes, and switch to kzalloc so any future copy size mismatch cannot leak heap data.8d CVE-2026-168387.0 HIG

0.7%

——0IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check to time-of-use (TOCTOU) race condition.59d CVE-2026-553176.7 MED

0.7%

——0In printf of printf.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.31d CVE-2026-23118—

——0——CVE-2026-570064.4 MED

0.7%

——0In acfw_ffa.c, there is a possible secret read due to a logic error in the code. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.34d CVE-2026-569326.7 MED

0.7%

——0In Trusted Execution Environment, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.31d CVE-2022-33695—

0.7%

——0——CVE-2025-22444—

0.7%

——0——CVE-2026-16526.1 MED

0.7%

——0A potential buffer overflow vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local authenticated user to corrupt memory and cause a Windows blue screen error.63d CVE-2022-20399—

——0——CVE-2026-240917.2 HIG

0.7%

——0Memory corruption while processing fastboot commands with improperly formatted input.92d