Vulnerabilities exploitable today
402,574in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,756
New KEV · 24H0
Exploit Today ≥ 701,689
Distribution · last window
- Critical4,727
- High18,786
- Medium17,140
- Low1,727
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2010-201039.8 CRI96.5%
——29A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.103dCVE-2013-4659—96.5%
——29——CVE-2002-1325—96.5%
——29——CVE-2016-0067—96.5%
——29——CVE-2025-7088—96.5%
——29——CVE-2026-26707.2 HIG96.5%
——29A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to address this issue. It is advisable to upgrade the affected component. The vendor explains: "The delete operation has been redesigned to map the requested file type to a fixed allowlisted path, require a numeric tunnel ID, reject invalid requests, and use the native filesystem API (fs.unlink) instead of constructing a shell command from request data."49dCVE-2019-8660—96.5%
——29——CVE-2019-1430—96.5%
——29——CVE-2019-6973—96.5%
——29——CVE-2021-29212—96.5%
——29——CVE-2021-213485.3 MED96.5%
——29XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.19dCVE-2016-3242—96.5%
——29——CVE-2020-17049—96.5%
——29——CVE-2013-6127—96.5%
——29——CVE-2025-52376—96.5%
——29——CVE-2009-4180—96.5%
——29——CVE-2022-24785—96.5%
——29——CVE-2016-0110—96.5%
——29——CVE-2016-0064—96.5%
——29——CVE-2016-0148—96.5%
——29——CVE-2024-7009—96.5%
——29——CVE-2015-6048—96.5%
——29——CVE-2025-5446—96.5%
——29——CVE-2018-12463—96.5%
——29——CVE-2006-2878—96.5%
——29——CVE-2026-22755—96.5%
——29——CVE-2017-7783—96.5%
——29——CVE-2006-1985—96.5%
——29——CVE-2016-6883—96.5%
——29——CVE-2015-0002—96.5%
——29——CVE-2023-50071—96.5%
——29——CVE-2025-5441—96.5%
——29——CVE-2004-0189—96.5%
——29——CVE-2002-1140—96.5%
——29——CVE-2001-1552—96.5%
——29——CVE-2019-204459.1 CRI96.5%
——29HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.18dCVE-2016-0008—96.5%
——29——CVE-2016-0071—96.5%
——29——CVE-2024-39288—96.5%
——29——CVE-2010-3127—96.5%
——29——