Vulnerabilities exploitable today
4,330in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,748
New KEV · 24H0
Exploit Today ≥ 701,665
Distribution · last window
- Critical3,347
- High15,203
- Medium14,178
- Low1,360
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2015-7007—99.0%
——30——CVE-2020-19677.5 HIG99.0%
——30Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).12dCVE-2006-2502—99.0%
——30——CVE-2022-330986.1 MED99.0%
——30Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted SVG document, with JavaScript, for a profile picture.104dCVE-2018-5006—99.0%
——30——CVE-2023-50231—99.0%
——30——CVE-1999-0191—99.0%
——30——CVE-2025-146119.8 CRI99.0%
KEV—80Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability13dCVE-2018-3949—99.0%
——30——CVE-2009-0043—99.0%
——30——CVE-2021-24307—99.0%
——30——CVE-2025-47188—99.0%
——30——CVE-2023-45249—99.0%
KEV—80Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability—CVE-2024-37843—99.0%
——30——CVE-2022-23940—99.0%
——30——CVE-2018-7739—99.0%
——30——CVE-2019-0541—99.0%
KEV—80Microsoft MSHTML Remote Code Execution Vulnerability—CVE-2008-3922—99.0%
——30——CVE-2025-12420—99.0%
——30——CVE-2022-1058—99.0%
——30——CVE-2014-8142—99.0%
——30——CVE-2026-105239.9 CRI99.0%
——30An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access89dCVE-2015-2419—99.0%
KEV—80Microsoft Internet Explorer Memory Corruption Vulnerability—CVE-2024-6396—99.0%
——30——CVE-2019-11577—99.0%
——30——CVE-2019-9760—99.0%
——30——CVE-2016-7434—99.0%
——30——CVE-2015-1642—99.0%
KEV—80Microsoft Office Memory Corruption Vulnerability—CVE-2010-0248—99.0%
——30——CVE-2018-0840—99.0%
——30——CVE-2023-362558.8 HIG99.0%
——30An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL.104dCVE-2020-12028—99.0%
——30——CVE-2012-2539—99.0%
KEV—80Microsoft Word Remote Code Execution Vulnerability—CVE-2020-12027—99.0%
——30——CVE-2019-0808—99.0%
KEV—80Microsoft Win32k Privilege Escalation Vulnerability—CVE-2021-38147—99.0%
——30——CVE-2009-0557—99.0%
KEV—80Microsoft Office Object Record Corruption Vulnerability—CVE-2009-1955—99.0%
——30——CVE-2024-32964—99.0%
——30——CVE-2007-5099—99.0%
——30——