Vulnerabilities exploitable today
4,330in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,748
New KEV · 24H0
Exploit Today ≥ 701,665
Distribution · last window
- Critical3,403
- High15,277
- Medium14,292
- Low1,366
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2019-20361—99.7%
——30——CVE-2023-40498—99.7%
——30——CVE-2022-41142—99.7%
——30——CVE-2020-262178.0 HIG99.7%
——30XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.13dCVE-2009-2335—99.7%
——30——CVE-2020-362217.5 HIG99.7%
——30An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck).7dCVE-2020-362287.5 HIG99.7%
——30An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service.7dCVE-2023-24955—99.7%
KEVR80Microsoft SharePoint Server Code Injection Vulnerability—CVE-2024-281825.3 MED99.7%
——30nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.6dCVE-2006-3439—99.7%
——30——CVE-2017-1001000—99.7%
——30——CVE-2017-14491—99.7%
——30——CVE-2020-11023—99.7%
KEV—80JQuery Cross-Site Scripting (XSS) Vulnerability—CVE-2003-0772—99.7%
——30——CVE-2023-32164—99.7%
——30——CVE-2013-3906—99.7%
KEV—80Microsoft Graphics Component Memory Corruption Vulnerability—CVE-2023-412668.2 HIG99.7%
KEVR80Qlik Sense Path Traversal Vulnerability77dCVE-2024-20328—99.7%
——30——CVE-2019-7214—99.7%
——30——CVE-2021-2401—99.7%
——30——CVE-2023-44352—99.7%
——30——CVE-2022-38111—99.7%
——30——CVE-2023-217169.8 CRI99.7%
——30Microsoft Word Remote Code Execution Vulnerability62dCVE-2004-0493—99.7%
——30——CVE-2022-24697—99.7%
——30——CVE-2019-8449—99.7%
——30——CVE-2023-28343—99.7%
——30——CVE-2002-0649—99.7%
——30——CVE-2019-10758—99.7%
KEV—80MongoDB mongo-express Remote Code Execution Vulnerability—CVE-2015-6132—99.7%
——30——CVE-2023-28128—99.7%
——30——CVE-2019-16663—99.7%
——30——CVE-2023-4542—99.7%
——30——CVE-2020-10923—99.7%
——30——CVE-2007-3925—99.7%
——30——CVE-2021-21029—99.7%
——30——CVE-2005-2278—99.7%
——30——CVE-2024-28986—99.7%
KEV—80SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability—CVE-2003-0201—99.7%
——30——CVE-2019-11581—99.7%
KEV—80Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability—