Vulnerabilities exploitable today
403,426in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,756
New KEV · 24H0
Exploit Today ≥ 701,689
Distribution · last window
- Critical5,556
- High21,532
- Medium19,936
- Low2,099
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-1999-1063—96.2%
——29——CVE-2014-8675—96.2%
——29——CVE-2019-6275—96.2%
——29——CVE-2021-460099.8 CRI96.2%
——29In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without cookies.110dCVE-2000-1003—96.2%
——29——CVE-2018-8898—96.2%
——29——CVE-2012-4513—96.2%
——29——CVE-2020-26073—96.2%
——29——CVE-2008-1193—96.2%
——29——CVE-2018-18850—96.2%
——29——CVE-2023-40507.5 HIG96.2%
——29In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash which could have led to a sandbox escape. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.3dCVE-2023-38667.5 HIG96.2%
——29In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate session id and tree id in the compound request
This patch validate session id and tree id in compound request.
If first operation in the compound is SMB2 ECHO request, ksmbd bypass
session and tree validation. So work->sess and work->tcon could be NULL.
If secound request in the compound access work->sess or tcon, It cause
NULL pointer dereferecing error.84dCVE-2019-1208—96.2%
——29——CVE-2020-357288.1 HIG96.2%
——29FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).62dCVE-2021-25159—96.2%
——29——CVE-2022-22806—96.2%
——29——CVE-2007-5184—96.2%
——29——CVE-2022-28233—96.2%
——29——CVE-2018-10285—96.2%
——29——CVE-2019-0788—96.2%
——29——CVE-2022-28213—96.2%
——29——CVE-2006-3658—96.2%
——29——CVE-2010-3124—96.2%
——29——CVE-2001-0700—96.2%
——29——CVE-2006-2554—96.2%
——29——CVE-2016-0160—96.2%
——29——CVE-2020-369629.8 CRI96.2%
——29Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to trigger arbitrary command execution when the CSV is opened in spreadsheet applications.18dCVE-2009-3613—96.2%
——29——CVE-2017-5162—96.2%
——29——CVE-2014-5246—96.2%
——29——CVE-2022-27796—96.2%
——29——CVE-2017-0929—96.2%
——29——CVE-2004-1155—96.2%
——29——CVE-2011-4130—96.2%
——29——CVE-2018-1000226—96.2%
——29——CVE-2006-6263—96.2%
——29——CVE-2008-2321—96.2%
——29——CVE-2018-11538—96.2%
——29——CVE-2019-19774—96.2%
——29——CVE-2026-40383—96.2%
——29——