Vulnerabilities exploitable today
405,569in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,762
New KEV · 24H0
Exploit Today ≥ 701,694
Distribution · last window
- Critical5,599
- High21,713
- Medium20,102
- Low2,112
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2010-3039—95.1%
——29——CVE-2017-17110—95.1%
——29——CVE-2021-39510—95.1%
——29——CVE-2012-1530—95.1%
——29——CVE-2020-5752—95.1%
——29——CVE-2018-3693—95.1%
——29——CVE-2019-6690—95.1%
——29——CVE-2011-4715—95.1%
——29——CVE-2014-2783—95.1%
——29——CVE-2007-2482—95.1%
——29——CVE-2012-3262—95.1%
——29——CVE-2008-7124—95.1%
——29——CVE-2011-0488—95.1%
——29——CVE-2026-408717.2 HIG95.1%
——29mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the quarantine_category field via the Mailcow API. The /api/v1/add/mailbox endpoint stores quarantine_category without validation or sanitization. This value is later used by quarantine_notify.py, which constructs SQL queries using unsafe % string formatting instead of parameterized queries. This results in a delayed (second-order) SQL injection when the quarantine notification job executes, allowing an attacker to inject arbitrary SQL. Using a UNION SELECT, sensitive data (e.g., admin credentials) can be exfiltrated and rendered inside quarantine notification emails. Version 2026-03b fixes the vulnerability.3dCVE-2019-15823—95.1%
——29——CVE-2008-4323—95.1%
——29——CVE-2017-8499—95.1%
——29——CVE-2017-3108—95.1%
——29——CVE-2012-2399—95.1%
——29——CVE-2011-2894—95.1%
——29——CVE-2022-23121—95.1%
——29——CVE-2009-3094—95.1%
——29——CVE-2017-16924—95.1%
——29——CVE-2003-0143—95.1%
——29——CVE-2025-510855.3 MED95.1%
——29Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/SetSysTimeCfg. The manipulation of the argument `timeZone` and `timeType` leads to stack-based buffer overflow.117dCVE-1999-0060—95.1%
——29——CVE-2019-6487—95.0%
——29——CVE-2004-2694—95.0%
——29——CVE-2016-4387—95.0%
——29——CVE-2008-4558—95.0%
——29——CVE-1999-1537—95.0%
——29——CVE-2008-0379—95.0%
——29——CVE-2017-3092—95.0%
——29——CVE-2016-4222—95.0%
——29——CVE-2022-03917.5 HIG95.0%
——29A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.16dCVE-2010-3203—95.0%
——29——CVE-2020-12478—95.0%
——29——CVE-2018-12999—95.0%
——29——CVE-2012-0406—95.0%
——29——CVE-2008-0396—95.0%
——29——