Vulnerabilities exploitable today
405,327in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,762
New KEV · 24H0
Exploit Today ≥ 701,694
Distribution · last window
- Critical5,648
- High21,802
- Medium20,242
- Low2,110
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2007-0051—95.4%
——29——CVE-2012-0981—95.4%
——29——CVE-2018-4197—95.4%
——29——CVE-1999-0492—95.4%
——29——CVE-2022-41966—95.4%
——29——CVE-2026-32267—95.4%
——29——CVE-2014-1631—95.4%
——29——CVE-2021-27320—95.4%
——29——CVE-2017-15041—95.4%
——29——CVE-2009-0833—95.4%
——29——CVE-2026-334399.8 CRI95.4%
——29Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.97dCVE-2021-445335.3 MED95.4%
——29Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.21dCVE-2026-0926—95.4%
——29——CVE-2010-0519—95.4%
——29——CVE-2006-3735—95.4%
——29——CVE-2008-6922—95.4%
——29——CVE-2006-6493—95.4%
——29——CVE-2005-1052—95.4%
——29——CVE-2010-2931—95.4%
——29——CVE-2004-1298—95.4%
——29——CVE-2007-2270—95.4%
——29——CVE-2022-39802—95.3%
——29——CVE-2010-2004—95.4%
——29——CVE-2018-1000140—95.4%
——29——CVE-2007-2540—95.4%
——29——CVE-2009-0641—95.4%
——29——CVE-2022-2136—95.4%
——29——CVE-2019-9023—95.4%
——29——CVE-2007-5305—95.4%
——29——CVE-2009-0945—95.4%
——29——CVE-2015-7945—95.4%
——29——CVE-2020-28026—95.4%
——29——CVE-2018-9038—95.4%
——29——CVE-2009-3840—95.4%
——29——CVE-2025-595387.5 HIG95.4%
——29Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic. A single unauthenticated HTTP POST is enough to kill the process. This issue is resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.17dCVE-2018-16021—95.4%
——29——CVE-2022-37989—95.4%
——29——CVE-2022-28365—95.4%
——29——CVE-2002-1486—95.4%
——29——CVE-2007-0480—95.4%
——29——