Vulnerabilities exploitable today
401,106in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,665
Distribution · last window
- Critical3,441
- High15,704
- Medium14,721
- Low1,447
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2017-8731—98.9%
——30——CVE-2023-25652—98.9%
——30——CVE-2018-11763—98.9%
——30——CVE-2009-1534—98.9%
——30——CVE-2006-6133—98.9%
——30——CVE-2017-3548—98.9%
——30——CVE-1999-0046—98.9%
——30——CVE-2009-0714—98.9%
——30——CVE-2008-2431—98.9%
——30——CVE-2008-0111—98.9%
——30——CVE-2010-4052—98.9%
——30——CVE-2013-1847—98.9%
——30——CVE-2009-1536—98.9%
——30——CVE-2016-0199—98.9%
——30——CVE-2018-0946—98.9%
——30——CVE-2016-3288—98.9%
——30——CVE-2005-1018—98.9%
——30——CVE-2010-2309—98.9%
——30——CVE-2002-0563—98.9%
——30——CVE-2018-250327.5 HIG98.9%
——30zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.8dCVE-2023-3450—98.9%
——30——CVE-2024-24725—98.9%
——30——CVE-2011-0522—98.9%
——30——CVE-2016-53888.1 HIG98.9%
——30Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.6dCVE-2025-40552—98.9%
——30——CVE-2021-33553—98.9%
——30——CVE-2025-5394—98.9%
——30——CVE-2025-49533—98.9%
——30——CVE-2020-11946—98.9%
——30——CVE-2017-1000083—98.9%
——30——CVE-2017-7925—98.9%
——30——CVE-2018-1217—98.9%
——30——CVE-2021-369527.8 HIG98.9%
——30Visual Studio Remote Code Execution Vulnerability72dCVE-2024-265949.1 CRI98.9%
——30In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate mech token in session setup
If client send invalid mech token in session setup request, ksmbd
validate and make the error if it is invalid.79dCVE-2024-38018—98.9%
——30——CVE-2001-0167—98.9%
——30——CVE-2016-0957—98.9%
——30——CVE-2015-4632—98.9%
——30——CVE-2007-3034—98.9%
——30——CVE-2005-2223—98.9%
——30——