Vulnerabilities exploitable today
401,110in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,666
Distribution · last window
- Critical3,437
- High15,688
- Medium14,711
- Low1,445
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-21006—0.6%
——0——CVE-2026-35364—0.6%
——0——CVE-2023-42673—0.6%
——0——CVE-2023-42677—0.6%
——0——CVE-2025-582835.5 MED0.6%
——0Permission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service confidentiality.14dCVE-2026-02684.4 MED0.6%
——0A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel.
This does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.91dCVE-2023-20970—0.6%
——0——CVE-2023-42714—0.6%
——0——CVE-2023-42709—0.6%
——0——CVE-2023-21254—0.6%
——0——CVE-2026-0541—0.6%
——0——CVE-2023-21276—0.6%
——0——CVE-2022-42775—0.6%
——0——CVE-2023-42702—0.6%
——0——CVE-2024-40661—0.6%
——0——CVE-2025-224326.7 MED0.6%
——0In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could lead to local escalation of privilege and background activity launches with User execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-972995.4 MED0.6%
——0Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.22dCVE-2026-1040325.5 MED0.6%
——0A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of Service (DoS) from degraded automount availability and elevated resource consumption.16dCVE-2023-20981—0.6%
——0——CVE-2026-103548—0.6%
——0Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.21dCVE-2024-23707—0.6%
——0——CVE-2023-21292—0.6%
——0——CVE-2026-181246.5 MED0.6%
——0IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information due to insufficiently protected credentials.15dCVE-2023-21030—0.6%
——0——CVE-2023-20986—0.6%
——0——CVE-2023-42676—0.6%
——0——CVE-2023-42711—0.6%
——0——CVE-2023-42675—0.6%
——0——CVE-2026-1100084.2 MED0.6%
——0@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the original cookies survive the callback and the documented single-use guarantee for the state value does not hold. A state value an attacker learns stays valid for the rest of the browser session, letting the attacker drive their own authorization flow in the victim's browser and sign the victim in to the attacker's account (login CSRF). The issue is fixed in @fastify/oauth2 8.3.2, and users should upgrade to 8.3.2 or later. As a workaround, set an explicit cookie path so the set and the clear name the same cookie.3dCVE-2026-1101505.5 MED0.6%
——0Privilege elevation in Installer in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: High)8dCVE-2023-21056—0.6%
——0——CVE-2022-20294—0.6%
——0——CVE-2026-1040415.5 MED0.6%
——0A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch (NSS) responder. Because the negative cache does not limit the total number of stored entries and only removes expired records when an existing key is rechecked, the cache can grow without bound. This behavior can lead to memory exhaustion, resulting in a Denial of Service (DoS) as the responder becomes unresponsive or terminates.16dCVE-2025-22413—0.6%
——0——CVE-2024-20005—0.6%
——0——CVE-2023-21070—0.6%
——0——CVE-2026-23362—0.6%
——0——CVE-2023-20643—0.6%
——0——CVE-2023-21063—0.6%
——0——CVE-2023-21038—0.6%
——0——