Vulnerabilities exploitable today
403,917in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,758
New KEV · 24H0
Exploit Today ≥ 701,691
Distribution · last window
- Critical5,616
- High21,711
- Medium20,117
- Low2,110
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2005-2968—95.8%
——29——CVE-2019-16702—95.8%
——29——CVE-2010-0288—95.8%
——29——CVE-2004-0194—95.8%
——29——CVE-2001-0432—95.8%
——29——CVE-2026-275779.9 CRI95.8%
——29n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, additional exploits in the expression evaluation of n8n have been identified and patched following CVE-2025-68613. An authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate all known vulnerabilities. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only, and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.92dCVE-2025-151368.8 HIG95.8%
——29A security vulnerability has been detected in TRENDnet TEW-800MB 1.0.1.0. Affected is the function do_setWizard_asp of the file /goform/wizardset of the component Management Interface. The manipulation of the argument WizardConfigured leads to command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.20dCVE-2018-4886—95.8%
——29——CVE-2024-51982—95.8%
——29——CVE-2018-4889—95.8%
——29——CVE-2020-15160—95.8%
——29——CVE-2010-1299—95.8%
——29——CVE-2020-8641—95.8%
——29——CVE-2015-2682—95.8%
——29——CVE-2021-20136—95.8%
——29——CVE-2002-0617—95.8%
——29——CVE-2007-6697—95.8%
——29——CVE-2013-4559—95.8%
——29——CVE-2019-0860—95.8%
——29——CVE-2006-2388—95.8%
——29——CVE-2002-0595—95.8%
——29——CVE-2018-4896—95.8%
——29——CVE-2018-4893—95.8%
——29——CVE-2009-0755—95.8%
——29——CVE-2014-9456—95.8%
——29——CVE-2009-2958—95.8%
——29——CVE-2018-4912—95.8%
——29——CVE-2024-44466—95.8%
——29——CVE-2001-0013—95.8%
——29——CVE-2007-3806—95.8%
——29——CVE-2014-5261—95.8%
——29——CVE-2010-4267—95.8%
——29——CVE-2018-4880—95.8%
——29——CVE-2010-1932—95.8%
——29——CVE-2020-8615—95.8%
——29——CVE-2008-0619—95.8%
——29——CVE-2018-4907—95.8%
——29——CVE-2018-4887—95.8%
——29——CVE-2010-0024—95.8%
——29——CVE-2025-663998.8 HIG95.8%
——29Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functionality. An authenticated Cacti user can supply crafted SNMP community strings containing control characters (including newlines) that are accepted, stored verbatim in the database, and later embedded into backend SNMP operations. In environments where downstream SNMP tooling or wrappers interpret newline-separated tokens as command boundaries, this can lead to unintended command execution with the privileges of the Cacti process. This vulnerability is fixed in 1.2.29.9d