Vulnerabilities exploitable today
402,574in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,756
New KEV · 24H0
Exploit Today ≥ 701,689
Distribution · last window
- Critical4,727
- High18,786
- Medium17,140
- Low1,727
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2015-2480—96.5%
——29——CVE-2008-5551—96.5%
——29——CVE-2007-6731—96.5%
——29——CVE-2025-4270—96.5%
——29——CVE-2017-0104—96.5%
——29——CVE-2023-50071—96.5%
——29——CVE-2010-3127—96.5%
——29——CVE-2015-4551—96.5%
——29——CVE-2010-2028—96.5%
——29——CVE-2005-1275—96.5%
——29——CVE-2009-1856—96.5%
——29——CVE-2001-1552—96.5%
——29——CVE-2016-0008—96.5%
——29——CVE-2025-5442—96.5%
——29——CVE-2020-22840—96.5%
——29——CVE-2024-7009—96.5%
——29——CVE-2017-7230—96.5%
——29——CVE-2026-438257.3 HIG96.5%
——29Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel
Versions Affected:
before 3.0.0-M4 (libsvm document categorization module; introduced in
OPENNLP-1808 and only present on the 3.x line)
Description:
SvmDoccatModel.deserialize(InputStream) reads an attacker-controlled
stream with java.io.ObjectInputStream and calls readObject() without an
ObjectInputFilter installed. ObjectInputStream materialises every class
referenced in the stream before the resulting object is cast to
SvmDoccatModel, so the cast that follows readObject() executes only
after the foreign object graph has already been deserialised in full.
If a Java deserialization gadget chain is available on the consumer's
classpath, a crafted payload supplied to
deserialize() executes arbitrary code in the JVM that loads it. Apache
OpenNLP itself does not ship a known gadget chain, so the realistic
risk is to downstream applications that embed the libsvm module
alongside vulnerable transitive dependencies. The method is public and
static, so any caller can pass an untrusted stream to it directly.
The practical impact is remote code execution against processes that
load SvmDoccatModel instances from untrusted or semi-trusted origins.
Mitigation:
3.x users should upgrade to 3.0.0-M4.
Users who cannot upgrade immediately should treat all serialized
SvmDoccatModel streams as untrusted input unless their provenance is
verified, and should avoid invoking SvmDoccatModel.deserialize() on
streams supplied by end users or fetched from third-party sources
without integrity checks.110dCVE-2019-204459.1 CRI96.5%
——29HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.17dCVE-2017-0264—96.5%
——29——CVE-2009-3846—96.5%
——29——CVE-2023-23560—96.5%
——29——CVE-2010-3426—96.5%
——29——CVE-2009-1257—96.5%
——29——CVE-2002-1140—96.5%
——29——CVE-2005-3077—96.5%
——29——CVE-2024-39288—96.5%
——29——CVE-2016-0071—96.5%
——29——CVE-2013-6127—96.5%
——29——CVE-2012-1882—96.5%
——29——CVE-2009-1675—96.5%
——29——CVE-2021-213485.3 MED96.5%
——29XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.19dCVE-2017-7478—96.5%
——29——CVE-2016-6307—96.5%
——29——CVE-2016-0067—96.5%
——29——CVE-2016-6883—96.5%
——29——CVE-2021-29212—96.5%
——29——CVE-2026-22755—96.5%
——29——CVE-2026-44809.0 CRI96.5%
——29A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J"
substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.55dCVE-2023-3215—96.5%
——29——