Vulnerabilities exploitable today
4,330in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,748
New KEV · 24H0
Exploit Today ≥ 701,665
Distribution · last window
- Critical3,347
- High15,203
- Medium14,178
- Low1,360
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2018-0802—99.8%
KEVR80Microsoft Office Memory Corruption Vulnerability—CVE-2016-7552—99.8%
——30——CVE-2022-33891—99.8%
KEV—80Apache Spark Command Injection Vulnerability—CVE-2020-5849—99.8%
KEV—80Unraid Authentication Bypass Vulnerability—CVE-2024-45507—99.8%
——30——CVE-2012-1425—99.8%
——30——CVE-2021-20080—99.8%
——30——CVE-2015-5371—99.8%
——30——CVE-2021-27905—99.8%
——30——CVE-2023-0992—99.8%
——30——CVE-2016-4437—99.8%
KEV—80Apache Shiro Code Execution Vulnerability—CVE-2024-2389—99.8%
——30——CVE-2021-40870—99.8%
KEV—80Aviatrix Controller Unrestricted Upload of File—CVE-2005-1983—99.8%
——30——CVE-2024-6670—99.8%
KEVR80Progress WhatsUp Gold SQL Injection Vulnerability—CVE-2023-20273—99.8%
KEV—80Cisco IOS XE Web UI Command Injection Vulnerability—CVE-2026-8570610.0 CRI99.8%
KEV—80GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability26dCVE-2021-38156—99.8%
——30——CVE-2021-2190—99.8%
——30——CVE-2016-4010—99.8%
——30——CVE-2021-37539—99.8%
——30——CVE-2019-15976—99.8%
——30——CVE-2018-10561—99.8%
KEV—80Dasan GPON Routers Authentication Bypass Vulnerability—CVE-2023-35628—99.8%
——30——CVE-2020-2551—99.8%
KEV—80Oracle Fusion Middleware Unspecified Vulnerability—CVE-2025-342918.8 HIG99.8%
KEV—80Langflow Origin Validation Error Vulnerability5dCVE-2022-0847—99.8%
KEV—80Linux Kernel Privilege Escalation Vulnerability—CVE-2020-2096—99.8%
——30——CVE-2022-21907—99.8%
——30——CVE-2025-34037—99.8%
——30An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.90dCVE-2024-45216—99.8%
——30——CVE-2016-7547—99.8%
——30——CVE-2022-1329—99.8%
——30——CVE-2022-21371—99.8%
——30——CVE-2023-28302—99.8%
——30——CVE-2026-422718.8 HIG99.8%
KEV—80BerriAI LiteLLM Command Injection Vulnerability98dCVE-2023-21758—99.8%
——30——CVE-2022-24706—99.8%
KEV—80Apache CouchDB Insecure Default Initialization of Resource Vulnerability—CVE-2007-0071—99.8%
——30——CVE-2018-16509—99.8%
——30——