Vulnerabilities exploitable today
403,479in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,756
New KEV · 24H0
Exploit Today ≥ 701,689
Distribution · last window
- Critical5,556
- High21,547
- Medium19,983
- Low2,101
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2007-2772—96.1%
——29——CVE-2024-34051—96.1%
——29——CVE-2016-44728.1 HIG96.1%
——29The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.18dCVE-2024-11003—96.1%
——29——CVE-2004-2179—96.1%
——29——CVE-1999-0909—96.1%
——29——CVE-2015-8921—96.1%
——29——CVE-2007-5962—96.1%
——29——CVE-2008-5695—96.1%
——29——CVE-2024-4257—96.1%
——29——CVE-2011-3165—96.1%
——29——CVE-2005-3694—96.1%
——29——CVE-2016-7250—96.1%
——29——CVE-1999-1529—96.1%
——29——CVE-2014-5461—96.1%
——29——CVE-2010-3894—96.1%
——29——CVE-2020-0992—96.1%
——29——CVE-2018-0772—96.1%
——29——CVE-2021-25140—96.1%
——29——CVE-2019-0222—96.1%
——29——CVE-2020-0889—96.1%
——29——CVE-2001-0665—96.1%
——29——CVE-2006-4095—96.1%
——29——CVE-2004-2104—96.1%
——29——CVE-2002-1262—96.1%
——29——CVE-2012-5862—96.1%
——29——CVE-2020-0953—96.1%
——29——CVE-2018-6397—96.1%
——29——CVE-2005-1806—96.1%
——29——CVE-2019-2698—96.1%
——29——CVE-2025-141068.8 HIG96.1%
——29A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected is the function zfilev2_api.CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. The manipulation of the argument safe_dir leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.31dCVE-2015-3097—96.1%
——29——CVE-2022-20649—96.1%
——29——CVE-2026-409339.9 CRI96.1%
——29Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution. The vulnerability lies in a bug in the input sanitization from the “Custom MCP” configuration in http://localhost:3000/canvas - where any user can add a new MCP, when doing so - adding a new MCP using stdio, the user can add any command, even though your code have input sanitization checks such as validateCommandInjection and validateArgsForLocalFileAccess, and a list of predefined specific safe commands - these commands, for example "npx" can be combined with code execution arguments ("-c touch /tmp/pwn") that enable direct code execution on the underlying OS. This vulnerability is fixed in 3.1.0.9hCVE-2015-2398—96.1%
——29——CVE-2024-8529—96.1%
——29——CVE-2009-4017—96.1%
——29——CVE-2008-6714—96.1%
——29——CVE-2016-5677—96.1%
——29——CVE-2008-0394—96.1%
——29——