Vulnerabilities exploitable today
405,425in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,762
New KEV · 24H0
Exploit Today ≥ 701,694
Distribution · last window
- Critical5,620
- High21,749
- Medium20,106
- Low2,112
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2014-8447—95.2%
——29——CVE-2018-5954—95.2%
——29——CVE-2019-0806—95.2%
——29——CVE-2013-3541—95.2%
——29——CVE-2004-1269—95.2%
——29——CVE-2026-34472—95.2%
——29——CVE-2012-0775—95.2%
——29——CVE-2014-8445—95.2%
——29——CVE-2015-1629—95.2%
——29——CVE-2006-4131—95.2%
——29——CVE-2007-0445—95.2%
——29——CVE-2009-0134—95.2%
——29——CVE-2014-4611—95.2%
——29——CVE-2007-5253—95.2%
——29——CVE-2007-0976—95.2%
——29——CVE-2011-1715—95.2%
——29——CVE-2007-5245—95.2%
——29——CVE-2016-15043—95.2%
——29——CVE-2011-0761—95.2%
——29——CVE-2025-4883—95.2%
——29——CVE-2016-1114—95.2%
——29——CVE-2014-4874—95.2%
——29——CVE-2013-0145—95.2%
——29——CVE-2011-0603—95.2%
——29——CVE-2026-291467.5 HIG95.2%
——29Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.
Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.3dCVE-2018-14883—95.2%
——29——CVE-2023-44839—95.2%
——29——CVE-2018-0764—95.2%
——29——CVE-2019-175694.8 MED95.2%
——29The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.65dCVE-2018-120237.5 HIG95.2%
——29An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.14dCVE-2015-8841—95.2%
——29——CVE-2017-16404—95.2%
——29——CVE-2020-1073—95.2%
——29——CVE-2004-1236—95.2%
——29——CVE-2008-0364—95.2%
——29——CVE-2009-3658—95.2%
——29——CVE-2022-28082—95.2%
——29——CVE-2006-3104—95.2%
——29——CVE-2006-2555—95.2%
——29——CVE-2020-0831—95.2%
——29——