Vulnerabilities exploitable today
403,426in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,756
New KEV · 24H0
Exploit Today ≥ 701,689
Distribution · last window
- Critical5,557
- High21,535
- Medium19,938
- Low2,099
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2017-12373—96.3%
——29——CVE-2009-5092—96.3%
——29——CVE-2016-2170—96.2%
——29——CVE-2018-10354—96.2%
——29——CVE-2015-1638—96.2%
——29——CVE-2016-7153—96.2%
——29——CVE-1999-0870—96.2%
——29——CVE-2005-1163—96.2%
——29——CVE-2016-11818.1 HIG96.2%
——29ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.11dCVE-2017-0075—96.2%
——29——CVE-2019-3401—96.2%
——29——CVE-2009-0650—96.2%
——29——CVE-2022-27511—96.2%
——29——CVE-2014-0321—96.2%
——29——CVE-2019-0655—96.2%
——29——CVE-2022-26085—96.2%
——29——CVE-2020-144225.9 MED96.2%
——29Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.13dCVE-2014-3529—96.2%
——29——CVE-2014-0298—96.2%
——29——CVE-2008-5181—96.2%
——29——CVE-2019-16746—96.2%
——29——CVE-2022-0714—96.2%
——29——CVE-2017-14097—96.2%
——29——CVE-2002-1932—96.2%
——29——CVE-2019-0948—96.2%
——29——CVE-2021-32099—96.2%
——29——CVE-2024-34854—96.2%
——29——CVE-2009-0693—96.2%
——29——CVE-2020-8540—96.2%
——29——CVE-2025-127629.1 CRI96.2%
——29pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.8dCVE-2015-0057—96.2%
——29——CVE-2018-1002202—96.2%
——29——CVE-2018-16844—96.2%
——29——CVE-2018-9845—96.2%
——29——CVE-2008-0380—96.2%
——29——CVE-2009-1378—96.2%
——29——CVE-2018-147189.8 CRI96.2%
——29FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.18dCVE-2024-32394—96.2%
——29——CVE-2014-0306—96.2%
——29——CVE-2017-11834—96.2%
——29——