Vulnerabilities exploitable today
404,989in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,762
New KEV · 24H0
Exploit Today ≥ 701,694
Distribution · last window
- Critical5,617
- High21,773
- Medium20,163
- Low2,116
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2013-3934—95.5%
——29——CVE-2019-1453—95.5%
——29——CVE-2021-1571—95.5%
——29——CVE-2018-5925—95.5%
——29——CVE-2015-3058—95.5%
——29——CVE-2019-6250—95.5%
——29——CVE-2002-1357—95.5%
——29——CVE-2008-5406—95.5%
——29——CVE-2009-3241—95.5%
——29——CVE-2017-6635—95.5%
——29——CVE-2017-2958—95.5%
——29——CVE-1999-0182—95.5%
——29——CVE-2003-0436—95.5%
——29——CVE-2002-1180—95.5%
——29——CVE-2002-0616—95.5%
——29——CVE-2010-1316—95.5%
——29——CVE-2019-7760—95.5%
——29——CVE-2026-87118.1 HIG95.5%
——29NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.98dCVE-2024-9014—95.5%
——29——CVE-2007-4816—95.5%
——29——CVE-2010-3559—95.5%
——29——CVE-2014-4663—95.5%
——29——CVE-2017-0898—95.5%
——29——CVE-2016-4431—95.5%
——29——CVE-2019-7830—95.5%
——29——CVE-2003-0513—95.5%
——29——CVE-2012-4172—95.5%
——29——CVE-2025-417527.1 HIG95.5%
——29An XSS vulnerability in pxc_portSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.22dCVE-2008-3066—95.5%
——29——CVE-2004-0903—95.5%
——29——CVE-2023-37979—95.5%
——29——CVE-2025-417477.1 HIG95.5%
——29An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.22dCVE-2016-4535—95.5%
——29——CVE-2013-6629—95.5%
——29——CVE-2008-7103—95.5%
——29——CVE-2019-1427—95.5%
——29——CVE-2006-6299—95.5%
——29——CVE-2023-26876—95.5%
——29——CVE-2015-1399—95.5%
——29——CVE-2009-0193—95.5%
——29——