Vulnerabilities exploitable today
401,106in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,665
Distribution · last window
- Critical3,441
- High15,704
- Medium14,721
- Low1,447
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2018-8006—99.0%
——30——CVE-2023-42327—99.0%
——30——CVE-2018-0834—99.0%
——30——CVE-2020-94847.0 HIG99.0%
——30When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.13dCVE-2025-6970—99.0%
——30——CVE-2023-50223—99.0%
——30——CVE-2019-9516—99.0%
——30——CVE-2013-1469—99.0%
——30——CVE-2005-2124—99.0%
——30——CVE-2016-5387—99.0%
——30——CVE-2014-9708—99.0%
——30——CVE-2007-2485—99.0%
——30——CVE-2016-33577.8 HIG99.0%
——30Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word for Mac 2011, Word 2016 for Mac, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, SharePoint Server 2013 SP1, Excel Automation Services on SharePoint Server 2013 SP1, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."6dCVE-2022-22972—99.0%
——30——CVE-2016-6267—99.0%
——30——CVE-2010-2115—99.0%
——30——CVE-2024-53676—99.0%
——30——CVE-2023-32169—99.0%
——30——CVE-2023-31102—99.0%
——30——CVE-2005-2551—99.0%
——30——CVE-2021-45466—99.0%
——30——CVE-2008-4008—99.0%
——30——CVE-2023-0028—99.0%
——30——CVE-2006-0395—99.0%
——30——CVE-2020-139434.3 MED99.0%
——30If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.13dCVE-2021-39352—99.0%
——30——CVE-2023-41249—99.0%
——30——CVE-2022-38130—99.0%
——30——CVE-2020-35452—99.0%
——30——CVE-2022-25075—99.0%
——30——CVE-2013-0025—99.0%
——30——CVE-2011-3494—99.0%
——30——CVE-2007-4818—99.0%
——30——CVE-2006-4948—99.0%
——30——CVE-2023-40000—99.0%
——30——CVE-2018-19206—99.0%
——30——CVE-2014-7236—99.0%
——30——CVE-2018-8011—99.0%
——30——CVE-2017-8635—99.0%
——30——CVE-2007-2931—99.0%
——30——