Vulnerabilities exploitable today
402,527in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,756
New KEV · 24H0
Exploit Today ≥ 701,669
Distribution · last window
- Critical4,214
- High17,453
- Medium16,143
- Low1,571
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2001-0719—97.1%
——29——CVE-2017-0294—97.1%
——29——CVE-2002-1705—97.1%
——29——CVE-2014-0269—97.1%
——29——CVE-2006-3944—97.1%
——29——CVE-2012-4557—97.1%
——29——CVE-2021-24274—97.1%
——29——CVE-2007-2374—97.1%
——29——CVE-2010-2562—97.1%
——29——CVE-2013-5045—97.1%
——29——CVE-2017-10075—97.1%
——29——CVE-2015-1756—97.1%
——29——CVE-2014-4117—97.1%
——29——CVE-2020-24916—97.1%
——29——CVE-2025-4111510.0 CRI97.1%
——29SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.
In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation.
This vulnerability applies only if all of the following conditions are met:
- `enableSCIM` feature flag set to true
- `user_sync_enabled` config option in the `[auth.scim]` block set to true6dCVE-2017-12945—97.1%
——29——CVE-2016-7252—97.1%
——29——CVE-2012-4412—97.1%
——29——CVE-2014-00755.0 NO 97.1%
——29Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.10dCVE-2025-113314.7 MED97.1%
——29A vulnerability was found in IdeaCMS up to 1.8. The impacted element is an unknown function of the file app/common/logic/admin/Config.php of the component Website Name Handler. Performing manipulation of the argument 网站名称 results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.5dCVE-2024-55547—97.1%
——29——CVE-2022-29632—97.1%
——29——CVE-2023-27394—97.1%
——29——CVE-2025-712584.3 MED97.1%
——29BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests. Attackers can exploit improper URL validation to perform internal network scanning or interact with internal services, impacting system availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.79dCVE-2025-0283—97.1%
——29——CVE-2023-2833—97.1%
——29——CVE-2025-6793—97.1%
——29——CVE-2021-43527—97.1%
——29——CVE-2008-0236—97.1%
——29——CVE-2012-4787—97.1%
——29——CVE-2009-3019—97.1%
——29——CVE-2002-0152—97.1%
——29——CVE-2016-4176—97.1%
——29——CVE-2019-6446—97.1%
——29——CVE-2015-0092—97.1%
——29——CVE-2019-7838—97.1%
——29——CVE-2002-1288—97.1%
——29——CVE-2011-1960—97.1%
——29——CVE-2004-0393—97.1%
——29——CVE-2008-4493—97.1%
——29——