Vulnerabilities exploitable today
4,330in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,665
Distribution · last window
- Critical3,501
- High15,930
- Medium14,893
- Low1,472
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2014-0780—99.5%
KEV—80InduSoft Web Studio NTWebServer Directory Traversal Vulnerability—CVE-2004-1060—99.5%
——30——CVE-2021-330375.3 MED99.5%
——30Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.13dCVE-2025-117499.8 CRI99.5%
——30The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract the bearer token, which can be used to gain access to a valid session and perform many actions like creating a new administrator account, leading to privilege escalation.3dCVE-2004-0206—99.5%
——30——CVE-1999-0874—99.5%
——30——CVE-2001-0550—99.5%
——30——CVE-2020-12124—99.5%
——30——CVE-2000-1089—99.5%
——30——CVE-2011-1563—99.5%
——30——CVE-2013-2115—99.5%
——30——CVE-2023-6019—99.5%
——30——CVE-2010-3653—99.5%
——30——CVE-2016-1542—99.5%
——30——CVE-2022-0169—99.5%
——30——CVE-2008-4193—99.5%
——30——CVE-2005-2773—99.5%
KEV—80HP OpenView Network Node Manager Remote Code Execution Vulnerability—CVE-2020-35848—99.5%
——30——CVE-2017-8046—99.5%
——30——CVE-2013-7390—99.5%
——30——CVE-2007-3370—99.5%
——30——CVE-2020-24391—99.5%
——30——CVE-2012-5159—99.5%
——30——CVE-2021-27272—99.5%
——30——CVE-1999-0128—99.5%
——30——CVE-2020-1421—99.5%
——30——CVE-2025-20337—99.5%
KEV—80Cisco Identity Services Engine Injection Vulnerability—CVE-2015-5374—99.5%
——30——CVE-2021-37538—99.5%
——30——CVE-2025-1316—99.5%
KEV—80Edimax IC-7100 IP Camera OS Command Injection Vulnerability—CVE-2015-1497—99.5%
——30——CVE-2019-13345—99.5%
——30——CVE-2019-12991—99.5%
KEV—80Citrix SD-WAN and NetScaler Command Injection Vulnerability—CVE-2023-49085—99.5%
——30——CVE-2020-11854—99.5%
——30——CVE-2019-1003029—99.5%
KEV—80Jenkins Script Security Plugin Sandbox Bypass Vulnerability—CVE-2020-3248—99.5%
——30——CVE-2019-14587.8 HIG99.5%
KEVR80Microsoft Win32k Privilege Escalation Vulnerability70dCVE-2021-42258—99.5%
KEVR80BQE BillQuick Web Suite SQL Injection Vulnerability—CVE-2017-8543—99.5%
KEV—80Microsoft Windows Search Remote Code Execution Vulnerability—