Vulnerabilities exploitable today
402,574in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,756
New KEV · 24H0
Exploit Today ≥ 701,689
Distribution · last window
- Critical4,727
- High18,786
- Medium17,140
- Low1,727
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2019-12419—96.5%
——29——CVE-2026-44809.0 CRI96.5%
——29A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J"
substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.55dCVE-2019-8660—96.5%
——29——CVE-2024-39288—96.5%
——29——CVE-2016-0064—96.5%
——29——CVE-2002-1076—96.5%
——29——CVE-2001-0347—96.5%
——29——CVE-2010-4300—96.5%
——29——CVE-2016-0105—96.5%
——29——CVE-2001-0129—96.5%
——29——CVE-2013-2135—96.5%
——29——CVE-2010-201039.8 CRI96.5%
——29A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.103dCVE-2025-5571—96.5%
——29——CVE-2016-3240—96.5%
——29——CVE-2019-1060—96.5%
——29——CVE-2004-1364—96.5%
——29——CVE-2009-1856—96.5%
——29——CVE-2024-8182—96.5%
——29——CVE-2007-0444—96.5%
——29——CVE-2021-213485.3 MED96.5%
——29XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.19dCVE-2016-6307—96.5%
——29——CVE-2020-27600—96.5%
——29——CVE-2025-5446—96.5%
——29——CVE-2014-9473—96.5%
——29——CVE-2008-1933—96.5%
——29——CVE-2016-7181—96.5%
——29——CVE-2010-2028—96.5%
——29——CVE-2002-1140—96.5%
——29——CVE-2022-24785—96.5%
——29——CVE-2016-0008—96.5%
——29——CVE-2019-204459.1 CRI96.5%
——29HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.18dCVE-2020-17049—96.5%
——29——CVE-2019-1430—96.5%
——29——CVE-2023-20036—96.5%
——29——CVE-2006-3276—96.5%
——29——CVE-2024-7009—96.5%
——29——CVE-2025-52376—96.5%
——29——CVE-2024-30571—96.5%
——29——CVE-2016-6883—96.5%
——29——CVE-2002-1325—96.5%
——29——