Vulnerabilities exploitable today
405,327in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,762
New KEV · 24H0
Exploit Today ≥ 701,694
Distribution · last window
- Critical5,616
- High21,702
- Medium20,076
- Low2,086
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2004-0782—95.3%
——29——CVE-2016-1558—95.3%
——29——CVE-2003-0044—95.3%
——29——CVE-2011-2194—95.3%
——29——CVE-2005-2390—95.3%
——29——CVE-2007-6318—95.3%
——29——CVE-2026-581389.8 CRI95.3%
——29Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.4dCVE-2007-1319—95.3%
——29——CVE-2007-6276—95.3%
——29——CVE-2026-93128.2 HIG95.3%
——29A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted requests to internal services by exploiting insufficient input validation in an upload endpoint. By injecting path traversal content into request parameters, an attacker could bypass the intended request flow and redirect internal API calls, potentially accessing internal services and exposing sensitive credentials. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, 3.20.4, and 3.21.2. This vulnerability was reported via the GitHub Bug Bounty program.98dCVE-2014-0166—95.3%
——29——CVE-2019-18676—95.3%
——29——CVE-2018-5043—95.3%
——29——CVE-2023-4430—95.3%
——29——CVE-2013-43224.3 NO 95.3%
——29Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.20dCVE-2014-5112—95.3%
——29——CVE-2014-3848—95.3%
——29——CVE-2021-43495—95.3%
——29——CVE-2014-3577—95.3%
——29——CVE-2023-47681—95.3%
——29——CVE-2018-13336—95.3%
——29——CVE-2007-6420—95.3%
——29——CVE-2015-5300—95.3%
——29——CVE-2002-1984—95.3%
——29——CVE-2004-1300—95.3%
——29——CVE-2018-5057—95.3%
——29——CVE-2022-45672—95.3%
——29——CVE-2004-2496—95.3%
——29——CVE-2020-11612—95.3%
——29——CVE-2017-16086—95.3%
——29——CVE-2008-5660—95.3%
——29——CVE-2019-0205—95.3%
——29——CVE-2005-3670—95.3%
——29——CVE-2012-0991—95.3%
——29——CVE-2014-8997—95.3%
——29——CVE-2004-0769—95.3%
——29——CVE-2005-2378—95.3%
——29——CVE-2023-43662—95.3%
——29——CVE-2004-1264—95.3%
——29——CVE-2012-44314.3 NO 95.3%
——29org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.20d