Vulnerabilities exploitable today
401,106in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,665
Distribution · last window
- Critical3,441
- High15,704
- Medium14,717
- Low1,446
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-2564—98.6%
——30——CVE-2020-17525—98.6%
——30——CVE-2023-35138—98.6%
——30——CVE-2024-46906—98.6%
——30——CVE-2019-18370—98.6%
——30——CVE-2024-42640—98.6%
——30——CVE-2024-36465—98.6%
——30——CVE-2024-1601—98.6%
——30——CVE-2019-10945—98.6%
——30——CVE-2012-3261—98.6%
——30——CVE-2005-1665—98.6%
——30——CVE-2011-0517—98.6%
——30——CVE-2011-0600—98.6%
——30——CVE-2003-0819—98.6%
——30——CVE-2009-3295—98.6%
——30——CVE-2018-14493—98.6%
——30——CVE-2007-5243—98.6%
——30——CVE-2008-1091—98.6%
——30——CVE-2009-0565—98.6%
——30——CVE-2023-4521—98.6%
——30——CVE-2020-24217—98.6%
——30——CVE-2023-20209—98.6%
——30——CVE-2021-233365.9 MED98.6%
——30The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.8dCVE-2007-5407—98.6%
——30——CVE-2011-1345—98.6%
——30——CVE-2014-8676—98.6%
——30——CVE-2019-18939—98.6%
——30——CVE-2007-5641—98.6%
——30——CVE-2014-4877—98.6%
——30——CVE-2009-1968—98.6%
——30——CVE-2016-6170—98.6%
——30——CVE-2024-5723—98.6%
——30——CVE-2009-1025—98.6%
——30——CVE-2012-3579—98.6%
——30——CVE-2013-1412—98.6%
——30——CVE-2009-2011—98.6%
——30——CVE-2022-250609.8 CRI98.6%
——30TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing.105dCVE-2006-1992—98.6%
——30——CVE-2020-249139.8 CRI98.6%
——30A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.105dCVE-2019-12593—98.6%
——30——