Vulnerabilities exploitable today
402,957in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,756
New KEV · 24H0
Exploit Today ≥ 701,689
Distribution · last window
- Critical5,149
- High20,192
- Medium18,526
- Low1,892
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2021-22192—96.3%
——29——CVE-2014-6376—96.3%
——29——CVE-2019-0772—96.3%
——29——CVE-2021-39863—96.3%
——29——CVE-2009-0159—96.3%
——29——CVE-2020-24948—96.3%
——29——CVE-2025-8184—96.3%
——29——CVE-2009-2464—96.3%
——29——CVE-2017-17731—96.3%
——29——CVE-2014-6373—96.3%
——29——CVE-2017-56489.1 CRI96.3%
——29While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.11dCVE-2024-48286—96.3%
——29——CVE-2016-0049—96.3%
——29——CVE-2020-11900—96.3%
——29——CVE-2011-1471—96.3%
——29——CVE-2004-0416—96.3%
——29——CVE-2013-3975—96.3%
——29——CVE-2012-5614—96.3%
——29——CVE-2016-8527—96.3%
——29——CVE-1999-0981—96.3%
——29——CVE-2009-0261—96.3%
——29——CVE-2020-23826—96.3%
——29——CVE-2020-16270—96.3%
——29——CVE-2007-2645—96.3%
——29——CVE-2008-1801—96.3%
——29——CVE-2005-2310—96.3%
——29——CVE-2020-4464—96.3%
——29——CVE-2012-2049—96.3%
——29——CVE-2017-15663—96.3%
——29——CVE-2006-6697—96.3%
——29——CVE-2017-12150—96.3%
——29——CVE-2019-1145—96.3%
——29——CVE-2016-07148.8 HIG96.3%
——29The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.11dCVE-2018-5001—96.3%
——29——CVE-2019-9792—96.3%
——29——CVE-1999-1043—96.3%
——29——CVE-2018-7921—96.3%
——29——CVE-2001-0197—96.3%
——29——CVE-2008-0153—96.3%
——29——CVE-2020-28903—96.3%
——29——