Vulnerabilities exploitable today
401,110in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,666
Distribution · last window
- Critical3,437
- High15,688
- Medium14,711
- Low1,445
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-42697—0.6%
——0——CVE-2026-1040355.5 MED0.6%
——0A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS) by maintaining a persistent connection and repeatedly storing and destroying credentials. Because the service fails to release cached objects from memory when credentials are removed, memory consumption grows continuously, ultimately exhausting available memory and rendering the service unresponsive.14dCVE-2023-20993—0.6%
——0——CVE-2026-766664.7 MED0.6%
——0A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.7dCVE-2023-42671—0.6%
——0——CVE-2023-32816—0.6%
——0——CVE-2023-42700—0.6%
——0——CVE-2022-20251—0.6%
——0——CVE-2025-15595—0.6%
——0——CVE-2026-102710—0.6%
——0Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` module issuing kernel dispatch calls, on a build with `TX_ENABLE_EVENT_TRACE`.
A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it directly — no validation, no trampoline — from privileged kernel code when the trace buffer wraps.
An invalid pointer faults the kernel (DoS). A pointer into the module's own code was observed running with kernel privilege (`CONTROL.nPRIV = 0`), confirmed at runtime with a register capture inside that code.23dCVE-2024-47124—0.6%
——0——CVE-2022-20341—0.6%
——0——CVE-2023-21011—0.6%
——0——CVE-2026-1040315.5 MED0.6%
——0A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS).16dCVE-2026-869555.5 MED0.6%
——0An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data.2dCVE-2022-47462—0.6%
——0——CVE-2026-180667.9 HIG0.6%
——0IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery.14dCVE-2019-2231—0.6%
——0——CVE-2025-22433—0.6%
——0——CVE-2026-569926.7 MED0.6%
——0In multiple files, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.34dCVE-2025-369287.8 HIG0.6%
——0In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2023-40137—0.6%
——0——CVE-2026-46194—0.6%
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6dCVE-2023-32815—0.6%
——0——CVE-2023-21017—0.6%
——0——CVE-2023-21008—0.6%
——0——CVE-2026-42487—0.6%
——0——CVE-2023-21010—0.6%
——0——CVE-2023-32807—0.6%
——0——CVE-2023-20982—0.6%
——0——CVE-2023-40138—0.6%
——0——CVE-2023-42712—0.6%
——0——CVE-2023-42707—0.6%
——0——CVE-2023-21099—0.6%
——0——CVE-2023-32826—0.6%
——0——CVE-2022-47461—0.6%
——0——CVE-2024-47031—0.6%
——0——CVE-2023-21277—0.6%
——0——CVE-2026-34499—0.6%
——0Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable.
This issue affects ADVMS: before 3.10.14dCVE-2025-369327.8 HIG0.6%
——0In tracepoint_msg_handler of cpm/google/lib/tracepoint/tracepoint_ipc.c, there is a possible memory overwrite due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15d