Vulnerabilities exploitable today
401,106in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,665
Distribution · last window
- Critical3,438
- High15,696
- Medium14,714
- Low1,445
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-20687—0.0%
——0——CVE-2026-286713.3 LOW0.0%
——0In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.29dCVE-2026-169357.8 HIG0.0%
——0IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a time-of-check to time-of-use (TOCTOU) race condition.59dCVE-2026-252616.7 MED0.0%
——0Memory corruption while processing rear sensor IOCTL calls.30dCVE-2026-112905.0 MED0.0%
——0Integer overflow in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to cause a denial of service via a malicious file. (Chromium security severity: Low)91dCVE-2025-57806—0.0%
——0——CVE-2026-0153—0.0%
——0——CVE-2026-575557.8 HIG0.0%
——0Memory Corruption when executing system service routines due to improper handling of user input buffers.13dCVE-2025-486485.5 MED0.0%
——0In isSameApp of NotificationManagerService.java, there is a possible persistent dos due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.92dCVE-2026-569886.4 MED0.0%
——0In multiple functions of bluetooth_cco.cc, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.34dCVE-2026-100288—0.0%
——0Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external identity provider tokens and active session identifiers via direct inspection of stored records.23dCVE-2026-575597.8 HIG0.0%
——0Memory corruption while processing service requests.13dCVE-2026-587247.0 HIG0.0%
——0In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.34dCVE-2024-47025—0.0%
——0——CVE-2026-252847.3 HIG0.0%
——0Information Disclosure when a pointer is reused after being deallocated.30dCVE-2026-00795.5 MED0.0%
——0In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.94dCVE-2025-264187.8 HIG0.0%
——0In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to a managed device due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.92dCVE-2026-169277.3 HIG0.0%
——0IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain root privileges due to a time-of-check to time-of-use (TOCTOU) race condition.59dCVE-2026-3428—0.0%
——0——CVE-2026-00425.5 MED0.0%
——0In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.92dCVE-2026-21002—0.0%
——0——CVE-2023-20620—0.0%
——0——CVE-2026-286477.8 HIG0.0%
——0In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.16dCVE-2024-34725—0.0%
——0——CVE-2023-20788—0.0%
——0——CVE-2026-252907.8 HIG0.0%
——0Memory Corruption when validating large data buffers from external sources using addition to check buffer length.30dCVE-2026-588807.0 HIG0.0%
——0In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-185674.4 MED0.0%
——0IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory.43dCVE-2026-286417.8 HIG0.0%
——0In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.16dCVE-2026-00705.5 MED0.0%
——0In multiple functions of DevicePolicyManagerService.java, there is a possible way to hide a system critical package due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.92dCVE-2026-816838.4 HIG0.0%
——0openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.50dCVE-2026-588547.8 HIG0.0%
——0In multiple locations, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-587017.0 HIG0.0%
——0In trusty_dputc of generic-arm64-smcall.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.34dCVE-2025-663277.1 HIG0.0%
——0Race condition vulnerability in the network module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.15dCVE-2026-588597.8 HIG0.0%
——0In multiple places, there is a possible denial of service due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2023-20686—0.0%
——0——CVE-2026-286257.8 HIG0.0%
——0In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.16dCVE-2018-4786——
——0Rejected reason: This candidate is unused by its CNA.4dCVE-2018-4785——
——0Rejected reason: This candidate is unused by its CNA.4dCVE-2026-1015025.0 MED—
——0Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported version that is affected is 26.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Trusted Answer Search executes to compromise Oracle Trusted Answer Search. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Trusted Answer Search accessible data as well as unauthorized read access to a subset of Oracle Trusted Answer Search accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Trusted Answer Search. CVSS 3.1 Base Score 5.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L).1d