Vulnerabilities exploitable today
401,110in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,666
Distribution · last window
- Critical3,438
- High15,695
- Medium14,714
- Low1,445
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-568796.7 MED0.6%
——0In gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.31dCVE-2026-587214.4 MED0.6%
——0In multiple locations, there is a possible information disclosure due to uninitialized memory use. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.34dCVE-2024-47030—0.6%
——0——CVE-2025-21425—0.6%
——0——CVE-2023-21048—0.6%
——0——CVE-2026-142736.5 MED0.6%
——0IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization.7dCVE-2025-20705—0.6%
——0——CVE-2025-27042—0.6%
——0——CVE-2026-210936.7 MED0.6%
——0Stack-based buffer overflow in PROCA trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory.41dCVE-2023-20798—0.5%
——0——CVE-2023-21384—0.6%
——0——CVE-2022-20344—0.6%
——0——CVE-2022-20262—0.6%
——0——CVE-2023-21169—0.6%
——0——CVE-2024-21462—0.6%
——0——CVE-2026-0115—0.6%
——0——CVE-2023-32821—0.5%
——0——CVE-2026-174425.1 MED0.6%
——0IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to credentials being written to trace logs in cleartext.42dCVE-2022-36849—0.6%
——0——CVE-2026-842508.4 HIG0.6%
——0IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component. A local attacker could exploit this vulnerability to recover the root password and gain root privileges.12dCVE-2022-20460—0.6%
——0——CVE-2023-21194—0.6%
——0——CVE-2022-20459—0.6%
——0——CVE-2023-21045—0.6%
——0——CVE-2023-21196—0.6%
——0——CVE-2022-20426—0.6%
——0——CVE-2022-20305—0.6%
——0——CVE-2023-21235—0.6%
——0——CVE-2024-39556—0.6%
——0——CVE-2022-30752—0.6%
——0——CVE-2023-21289—0.6%
——0——CVE-2026-112296.1 MED0.6%
——0Inappropriate implementation in Enterprise in Google Chrome prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation via physical access to the device. (Chromium security severity: Low)91dCVE-2026-210365.5 MED0.6%
——0Improper authorization in Samsung Internet prior to version 30.0.0.39 allows local attackers to access sensitive information.114dCVE-2026-798146.7 MED0.6%
——0An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent could allow malicious users on a local instance to elevate their user privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow a local attacker to execute arbitrary code with elevated privileges on the affected system.14dCVE-2023-21160—0.6%
——0——CVE-2026-944447.8 HIG0.6%
——0Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.7dCVE-2026-1129407.1 HIG0.6%
——0filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a writable adjacent hot journal is additionally required for attacker-chosen content overwrites. This issue is fixed in version 4.2.1.2dCVE-2026-645817.8 HIG0.6%
——0In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
xfrm_user_policy() clears the socket dst cache with __sk_dst_reset(),
i.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cache with
rcu_dereference_protected(), stores NULL and dst_release()s the old dst.
That is only safe if no other thread modifies sk_dst_cache concurrently.
For a connected UDP socket that does not hold: the transmit fast path
(udp_sendmsg -> sk_dst_check -> sk_dst_reset) resets the cache locklessly
with an atomic xchg(). A per-socket policy change racing a send can make
both sides observe the same old dst and each dst_release() it, dropping
the socket's single reference twice and freeing the xfrm_dst bundle while
it is still referenced:
BUG: KASAN: slab-use-after-free in dst_release
Write of size 4 at addr ffff88801897b6c0 by task exploit/155
Call Trace:
...
dst_release (... ./include/linux/rcuref.h:109)
xfrm_user_policy (./include/net/sock.h:2239 ./include/net/sock.h:2256 net/xfrm/xfrm_state.c:3053)
do_ip_setsockopt (net/ipv4/ip_sockglue.c:1347)
ip_setsockopt (net/ipv4/ip_sockglue.c:1417)
do_sock_setsockopt (net/socket.c:2368)
__sys_setsockopt (net/socket.c:2393)
__x64_sys_setsockopt (net/socket.c:2396)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Reachable by an unprivileged user via a user+network namespace.
Use the atomic sk_dst_reset() so the cache is cleared and released with a
single xchg(): whichever side wins releases the dst once, the other sees
NULL and does nothing. Behaviour is otherwise unchanged.3dCVE-2025-32323—0.6%
——0——CVE-2026-622046.6 MED0.6%
——0SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin access can overwrite existing trusted plugins by supplying mismatched packageName and repoURL parameters, achieving persistence across application restarts.10d