Vulnerabilities exploitable today
403,426in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,756
New KEV · 24H0
Exploit Today ≥ 701,689
Distribution · last window
- Critical5,557
- High21,535
- Medium19,938
- Low2,099
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-3785—96.3%
——29——CVE-2014-7876—96.3%
——29——CVE-2008-3685—96.3%
——29——CVE-2006-6121—96.3%
——29——CVE-2010-1411—96.3%
——29——CVE-2005-2629—96.3%
——29——CVE-2017-11259—96.3%
——29——CVE-2015-6061—96.3%
——29——CVE-2020-29395—96.3%
——29——CVE-2011-2505—96.3%
——29——CVE-2025-27892—96.3%
——29——CVE-2022-1373—96.3%
——29——CVE-2011-1850—96.3%
——29——CVE-2015-1666—96.3%
——29——CVE-2009-4653—96.3%
——29——CVE-2021-463547.5 HIG96.3%
——29Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increase the attack surface.110dCVE-2016-4052—96.3%
——29——CVE-2012-2371—96.3%
——29——CVE-2024-26218—96.3%
——29——CVE-2018-8461—96.3%
——29——CVE-2018-1000027—96.3%
——29——CVE-2014-6043—96.3%
——29——CVE-2010-4156—96.3%
——29——CVE-2014-3000—96.3%
——29——CVE-2018-8447—96.3%
——29——CVE-1999-1576—96.3%
——29——CVE-2020-24786—96.3%
——29——CVE-2026-35223—96.3%
——29——CVE-2014-3509—96.3%
——29——CVE-2005-1349—96.3%
——29——CVE-2004-0444—96.3%
——29——CVE-2018-8304—96.3%
——29——CVE-2019-1245—96.3%
——29——CVE-2011-1848—96.3%
——29——CVE-2021-24926—96.3%
——29——CVE-2024-36258—96.3%
——29——CVE-2017-16392—96.3%
——29——CVE-2024-54794—96.3%
——29——CVE-2018-6911—96.3%
——29——CVE-2026-444928.6 HIG96.3%
——29Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.45d