Vulnerabilities exploitable today
402,574in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,756
New KEV · 24H0
Exploit Today ≥ 701,689
Distribution · last window
- Critical4,727
- High18,786
- Medium17,140
- Low1,727
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2019-8660—96.5%
——29——CVE-2022-24785—96.5%
——29——CVE-2016-3242—96.5%
——29——CVE-2023-0603—96.5%
——29——CVE-2024-8182—96.5%
——29——CVE-2017-0104—96.5%
——29——CVE-2006-1985—96.5%
——29——CVE-2026-438257.3 HIG96.5%
——29Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel
Versions Affected:
before 3.0.0-M4 (libsvm document categorization module; introduced in
OPENNLP-1808 and only present on the 3.x line)
Description:
SvmDoccatModel.deserialize(InputStream) reads an attacker-controlled
stream with java.io.ObjectInputStream and calls readObject() without an
ObjectInputFilter installed. ObjectInputStream materialises every class
referenced in the stream before the resulting object is cast to
SvmDoccatModel, so the cast that follows readObject() executes only
after the foreign object graph has already been deserialised in full.
If a Java deserialization gadget chain is available on the consumer's
classpath, a crafted payload supplied to
deserialize() executes arbitrary code in the JVM that loads it. Apache
OpenNLP itself does not ship a known gadget chain, so the realistic
risk is to downstream applications that embed the libsvm module
alongside vulnerable transitive dependencies. The method is public and
static, so any caller can pass an untrusted stream to it directly.
The practical impact is remote code execution against processes that
load SvmDoccatModel instances from untrusted or semi-trusted origins.
Mitigation:
3.x users should upgrade to 3.0.0-M4.
Users who cannot upgrade immediately should treat all serialized
SvmDoccatModel streams as untrusted input unless their provenance is
verified, and should avoid invoking SvmDoccatModel.deserialize() on
streams supplied by end users or fetched from third-party sources
without integrity checks.110dCVE-2019-1430—96.5%
——29——CVE-2006-5536—96.5%
——29——CVE-2011-1508—96.5%
——29——CVE-2015-2484—96.5%
——29——CVE-2023-41183—96.5%
——29——CVE-2022-30286—96.5%
——29——CVE-2007-4498—96.5%
——29——CVE-2023-474157.5 HIG96.5%
——29Cypress Solutions CTM-200 v2.7.1.5600 and below was discovered to contain an OS command injection vulnerability via the cli_text parameter.109dCVE-2023-34563—96.5%
——29——CVE-2014-8730—96.5%
——29——CVE-2022-29329—96.5%
——29——CVE-2024-11728—96.5%
——29——CVE-2025-104416.3 MED96.5%
——29A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub_433F7C of the file version_upgrade.asp of the component jhttpd. The manipulation of the argument path results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.8dCVE-2020-1435—96.5%
——29——CVE-2019-0748—96.5%
——29——CVE-2023-7095—96.5%
——29——CVE-2024-6255—96.5%
——29——CVE-2025-62725—96.5%
——29Docker Compose trusts the path information embedded in remote OCI compose artifacts. When a layer includes the annotations com.docker.compose.extends or com.docker.compose.envfile, Compose joins the attacker‑supplied value from com.docker.compose.file/com.docker.compose.envfile with its local cache directory and writes the file there. This affects any platform or workflow that resolves remote OCI compose artifacts, Docker Desktop, standalone Compose binaries on Linux, CI/CD runners, cloud dev environments is affected. An attacker can escape the cache directory and overwrite arbitrary files on the machine running docker compose, even if the user only runs read‑only commands such as docker compose config or docker compose ps. This issue is fixed in v2.40.2.18dCVE-2005-3684—96.5%
——29——CVE-2007-0067—96.5%
——29——CVE-2022-29328—96.5%
——29——CVE-2002-1695—96.5%
——29——CVE-2021-34586—96.5%
——29——CVE-2009-1247—96.5%
——29——CVE-2011-0414—96.5%
——29——CVE-2004-0882—96.5%
——29——CVE-2023-31475—96.5%
——29——CVE-2019-6442—96.5%
——29——CVE-2019-6971—96.5%
——29——CVE-2019-0946—96.5%
——29——CVE-2025-5445—96.5%
——29——CVE-2009-4491—96.5%
——29——