Vulnerabilities exploitable today
401,738in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,667
Distribution · last window
- Critical3,399
- High15,528
- Medium14,782
- Low1,421
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-20284—97.9%
——29——CVE-2014-5006—97.9%
——29——CVE-2018-12617—97.9%
——29——CVE-2010-3324—97.9%
——29——CVE-2017-12936—97.9%
——29——CVE-2013-3145—97.9%
——29——CVE-2012-0018—97.9%
——29——CVE-2015-3193—97.9%
——29——CVE-2007-3030—97.9%
——29——CVE-2020-13944—97.9%
——29——CVE-2000-0709—97.9%
——29——CVE-2019-0572—97.9%
——29——CVE-2025-6934—97.9%
——29——CVE-2025-54918—97.9%
——29——CVE-2022-2863—97.9%
——29——CVE-2018-15152—97.9%
——29——CVE-2019-9518—97.9%
——29——CVE-2013-3150—97.9%
——29——CVE-2025-342278.8 HIG97.9%
——29Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.12dCVE-2016-2298—97.9%
——29——CVE-2016-3955—97.9%
——29——CVE-2003-1567—97.9%
——29——CVE-2026-217107.5 HIG97.9%
——29A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.
When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.
* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**65dCVE-2014-0277—97.9%
——29——CVE-2018-18980—97.9%
——29——CVE-2016-3255—97.9%
——29——CVE-2024-4701—97.9%
——29——CVE-2012-5863—97.9%
——29——CVE-2015-6136—97.9%
——29——CVE-2025-343929.8 CRI97.9%
——29Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload.9dCVE-1999-0725—97.9%
——29——CVE-2006-3880—97.9%
——29——CVE-2018-13358—97.9%
——29——CVE-2008-2947—97.9%
——29——CVE-2018-10143—97.9%
——29——CVE-2019-61106.8 MED97.9%
——29In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.9dCVE-2023-34990—97.9%
——29——CVE-2021-44080—97.9%
——29——CVE-2017-3076—97.9%
——29——CVE-2023-31983—97.9%
——29——