Vulnerabilities exploitable today
404,880in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,760
New KEV · 24H0
Exploit Today ≥ 701,693
Distribution · last window
- Critical5,627
- High21,803
- Medium20,190
- Low2,115
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-25579—95.7%
——29——CVE-2011-5009—95.7%
——29——CVE-2020-0920—95.7%
——29——CVE-2011-5181—95.7%
——29——CVE-2007-1825—95.7%
——29——CVE-2024-61279.8 CRI95.7%
——29BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. A remote, unauthenticated attacker can exploit this vulnerability over HTTP by acting as a normal agent, completing all cryptographic handshakes, and then triggering an upload of payload data containing a malicious path.106dCVE-2026-95156.3 MED95.7%
——29A vulnerability was detected in Totolink CA750-PoE 6.2c.510. The affected element is the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation of the argument plugin_version results in os command injection. The attack may be launched remotely. The exploit is now public and may be used.98dCVE-2006-5265—95.7%
——29——CVE-2018-1002205—95.7%
——29——CVE-2019-0769—95.7%
——29——CVE-2008-4910—95.7%
——29——CVE-2004-1288—95.7%
——29——CVE-2014-7888—95.7%
——29——CVE-2007-1376—95.7%
——29——CVE-2015-2281—95.7%
——29——CVE-2018-14729—95.7%
——29——CVE-2020-35737—95.7%
——29——CVE-2005-0643—95.7%
——29——CVE-2013-2344—95.7%
——29——CVE-2003-0729—95.7%
——29——CVE-2013-4841—95.7%
——29——CVE-2013-2348—95.7%
——29——CVE-2000-1204—95.7%
——29——CVE-2018-1002201—95.7%
——29——CVE-2004-0832—95.7%
——29——CVE-2002-0719—95.7%
——29——CVE-2014-3007—95.7%
——29——CVE-2004-0112—95.7%
——29——CVE-2018-15685—95.7%
——29——CVE-2013-5618—95.7%
——29——CVE-2013-2349—95.7%
——29——CVE-2013-20676.8 NO 95.7%
——29java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.19dCVE-2007-2715—95.7%
——29——CVE-2006-1730—95.7%
——29——CVE-2012-3283—95.7%
——29——CVE-2012-3275—95.7%
——29——CVE-2015-0346—95.7%
——29——CVE-2016-1100—95.7%
——29——CVE-2014-7895—95.7%
——29——CVE-2011-1552—95.7%
——29——