Vulnerabilities exploitable today
402,537in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,756
New KEV · 24H0
Exploit Today ≥ 701,669
Distribution · last window
- Critical4,455
- High18,105
- Medium16,660
- Low1,666
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2019-1128—97.1%
——29——CVE-2022-1232—97.1%
——29——CVE-2021-26294—97.1%
——29——CVE-2011-1261—97.1%
——29——CVE-2008-3873—97.1%
——29——CVE-2014-0280—97.1%
——29——CVE-2011-0263—97.1%
——29——CVE-2022-45925—97.1%
——29——CVE-2024-0881—97.1%
——29——CVE-2018-13045.9 MED97.1%
——29The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.9dCVE-2022-24218—97.1%
——29——CVE-2019-1122—97.1%
——29——CVE-2006-1900—97.1%
——29——CVE-2011-4109—97.1%
——29——CVE-2010-2943—97.1%
——29——CVE-2011-1273—97.1%
——29——CVE-2017-8692—97.1%
——29——CVE-2024-54502—97.1%
——29——CVE-2015-2479—97.1%
——29——CVE-2010-1531—97.1%
——29——CVE-2016-7195—97.1%
——29——CVE-2011-0262—97.1%
——29——CVE-2023-30149—97.1%
——29——CVE-2017-5811—97.1%
——29——CVE-2025-0868—97.1%
——29——CVE-2006-3354—97.1%
——29——CVE-2015-3440—97.0%
——29——CVE-2008-0250—97.0%
——29——CVE-2010-1956—97.1%
——29——CVE-2009-2509—97.1%
——29——CVE-2008-1190—97.1%
——29——CVE-2018-0301—97.1%
——29——CVE-2018-1333—97.1%
——29——CVE-2018-7669—97.1%
——29——CVE-2019-1121—97.1%
——29——CVE-2016-3375—97.1%
——29——CVE-2014-5119—97.1%
——29——CVE-2017-0228—97.1%
——29——CVE-2009-0093—97.1%
——29——CVE-2018-8296—97.1%
——29——