Vulnerabilities exploitable today
401,106in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,665
Distribution · last window
- Critical3,441
- High15,704
- Medium14,721
- Low1,446
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2021-3712—98.9%
——30——CVE-2023-1133—98.9%
——30——CVE-2021-26414—98.9%
——30——CVE-2023-46695—98.9%
——30——CVE-2015-5133—98.9%
——30——CVE-2010-3229—98.9%
——30——CVE-2024-1380—98.9%
——30——CVE-2002-0642—98.9%
——30——CVE-2024-8275—98.9%
——30——CVE-2015-5130—98.9%
——30——CVE-2011-3639—98.9%
——30——CVE-2002-0061—98.9%
——30——CVE-2025-7441—98.9%
——30——CVE-2016-33137.8 HIG98.9%
——30Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Office Memory Corruption Vulnerability."6dCVE-2013-3128—98.9%
——30——CVE-2015-2994—98.9%
——30——CVE-2017-14098—98.9%
——30——CVE-2010-0477—98.9%
——30——CVE-2022-21550—98.9%
——30——CVE-2024-33610—98.9%
——30——CVE-2025-49002—98.9%
——30——CVE-2021-39840—98.9%
——30——CVE-2007-4336—98.9%
——30——CVE-2022-31629—98.9%
——30——CVE-2019-20224—98.9%
——30——CVE-2001-1410—98.9%
——30——CVE-2010-0266—98.9%
——30——CVE-2021-35621—98.9%
——30——CVE-2023-44351—98.9%
——30——CVE-2019-54367.8 HIG98.9%
——30A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.8dCVE-2003-0309—98.9%
——30——CVE-2022-23833—98.9%
——30——CVE-2002-1217—98.9%
——30——CVE-2025-584349.8 CRI98.9%
——30Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). This vulnerability applies to both the cloud service (`cloud.flowiseai.com`) and self-hosted/local Flowise deployments that expose the same API. Commit 9e178d68873eb876073846433a596590d3d9c863 in version 3.0.6 secures password reset endpoints. Several recommended remediation steps are available. Do not return reset tokens or sensitive account details in API responses. Tokens must only be delivered securely via the registered email channel. Ensure `forgot-password` responds with a generic success message regardless of input, to avoid user enumeration. Require strong validation of the `tempToken` (e.g., single-use, short expiry, tied to request origin, validated against email delivery). Apply the same fixes to both cloud and self-hosted/local deployments. Log and monitor password reset requests for suspicious activity. Consider multi-factor verification for sensitive accounts.21dCVE-2006-0006—98.9%
——30——CVE-2017-6465—98.9%
——30——CVE-2017-8538—98.9%
——30——CVE-2013-1884—98.9%
——30——CVE-2021-213425.3 MED98.9%
——30XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.14dCVE-2007-2447—98.9%
——30——