Vulnerabilities exploitable today
404,989in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,762
New KEV · 24H0
Exploit Today ≥ 701,694
Distribution · last window
- Critical5,617
- High21,785
- Medium20,171
- Low2,116
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2018-5925—95.5%
——29——CVE-2012-1194—95.5%
——29——CVE-2018-19326—95.5%
——29——CVE-2007-4816—95.5%
——29——CVE-2019-7814—95.5%
——29——CVE-1999-0182—95.5%
——29——CVE-2016-4431—95.5%
——29——CVE-2025-52089—95.5%
——29——CVE-2002-1180—95.5%
——29——CVE-2023-26876—95.5%
——29——CVE-2012-4514—95.5%
——29——CVE-2017-2958—95.5%
——29——CVE-2002-0616—95.5%
——29——CVE-2010-2415—95.5%
——29——CVE-2019-7760—95.5%
——29——CVE-2011-5167—95.5%
——29——CVE-2020-27481—95.5%
——29——CVE-2015-5587—95.5%
——29——CVE-2023-2649—95.5%
——29——CVE-2004-0903—95.5%
——29——CVE-2001-1246—95.5%
——29——CVE-2006-1243—95.5%
——29——CVE-2011-1290—95.5%
——29——CVE-2016-0751—95.5%
——29——CVE-2019-7837—95.5%
——29——CVE-2025-417507.1 HIG95.5%
——29An XSS vulnerability in pxc_PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.22dCVE-2026-2182—95.5%
——29——CVE-2006-2134—95.5%
——29——CVE-2014-5074—95.5%
——29——CVE-2010-1813—95.5%
——29——CVE-2025-69542—95.5%
——29——CVE-2016-3542—95.5%
——29——CVE-2017-6635—95.5%
——29——CVE-2026-222186.5 MED95.5%
——29Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the attacker’s session. The resulting element identifier (chainlitKey) can then be used to retrieve the file contents via /project/file/<chainlitKey>, allowing disclosure of any file readable by the Chainlit service.107dCVE-2014-8460—95.5%
——29——CVE-2019-9832—95.5%
——29——CVE-2014-9116—95.5%
——29——CVE-2025-417487.1 HIG95.5%
——29An XSS vulnerability in pxc_Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.22dCVE-2018-17614—95.5%
——29——CVE-2019-7759—95.5%
——29——