Vulnerabilities exploitable today
402,558in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,756
New KEV · 24H0
Exploit Today ≥ 701,669
Distribution · last window
- Critical4,455
- High18,108
- Medium16,661
- Low1,668
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2005-1526—97.0%
——29——CVE-2015-6140—97.0%
——29——CVE-2017-56647.5 HIG97.0%
——29The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.10dCVE-2017-6315—97.0%
——29——CVE-2011-2012—97.0%
——29——CVE-2024-8669—97.0%
——29——CVE-2022-21820—97.0%
——29——CVE-2022-435517.5 HIG97.0%
——29A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.11dCVE-2014-4067—97.0%
——29——CVE-2020-15492—97.0%
——29——CVE-2018-0494—97.0%
——29——CVE-2022-22005—97.0%
——29——CVE-2017-5821—97.0%
——29——CVE-2006-2661—97.0%
——29——CVE-2017-0019—97.0%
——29——CVE-2018-19753—97.0%
——29——CVE-2015-0228—97.0%
——29——CVE-2024-39205—97.0%
——29——CVE-2014-2827—97.0%
——29——CVE-2015-1815—97.0%
——29——CVE-2013-0010—97.0%
——29——CVE-2024-25852—97.0%
——29——CVE-2015-6155—97.0%
——29——CVE-2017-8051—97.0%
——29——CVE-2016-1713—97.0%
——29——CVE-2015-0250—97.0%
——29——CVE-2014-2821—97.0%
——29——CVE-2022-24295—97.0%
——29——CVE-2024-44625—97.0%
——29——CVE-2012-0145—97.0%
——29——CVE-2016-4135—97.0%
——29——CVE-2022-26498—97.0%
——29——CVE-2014-4050—97.0%
——29——CVE-2022-0711—97.0%
——29——CVE-2007-5144—97.0%
——29——CVE-2011-0269—97.0%
——29——CVE-2015-1651—97.0%
——29——CVE-2018-15140—97.0%
——29——CVE-2001-0400—97.0%
——29——CVE-2024-41110—97.0%
——29——