Vulnerabilities exploitable today
406,192in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,766
New KEV · 24H0
Exploit Today ≥ 701,698
Distribution · last window
- Critical5,629
- High21,866
- Medium20,415
- Low2,119
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-8383—94.6%
——28——CVE-2022-36923—94.6%
——28——CVE-2018-6574—94.6%
——28——CVE-2007-2519—94.6%
——28——CVE-2017-8404—94.6%
——28——CVE-1999-0800—94.6%
——28——CVE-2011-4336—94.6%
——28——CVE-2019-11356—94.6%
——28——CVE-2009-5067—94.6%
——28——CVE-2008-2106—94.6%
——28——CVE-2014-4306—94.6%
——28——CVE-2019-110504.8 MED94.6%
——28When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.75dCVE-2013-2619—94.6%
——28——CVE-2004-0507—94.6%
——28——CVE-2013-2137—94.6%
——28——CVE-2024-6187—94.6%
——28——CVE-2018-6126—94.6%
——28——CVE-2015-6750—94.6%
——28——CVE-2012-6313—94.6%
——28——CVE-2004-0292—94.6%
——28——CVE-2019-15311—94.6%
——28——CVE-2009-3749—94.6%
——28——CVE-2013-0450—94.6%
——28——CVE-2012-5907—94.6%
——28——CVE-2014-3806—94.6%
——28——CVE-2016-0031—94.6%
——28——CVE-2024-11772—94.6%
——28——CVE-2026-428246.5 MED94.6%
——28Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.100dCVE-2000-0240—94.6%
——28——CVE-2022-0949—94.6%
——28——CVE-2000-09305.0 NO 94.6%
——28Pegasus Mail 3.12 allows remote attackers to read arbitrary files via an embedded URL that calls the mailto: protocol with a -F switch.38dCVE-2023-23787.2 HIG94.6%
——28A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown function of the component Web Management Interface. This manipulation of the argument suffix-rate-up causes command injection. The attack may be initiated remotely. The exploit has been published and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor position is that post-authentication issues are not accepted as vulnerabilities.114dCVE-2017-3060—94.6%
——28——CVE-2004-1696—94.6%
——28——CVE-2016-9499—94.6%
——28——CVE-2025-151316.3 MED94.6%
——28A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation results in command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.24dCVE-2013-4685—94.6%
——28——CVE-2008-4509—94.6%
——28——CVE-2014-3085—94.6%
——28——CVE-2008-4134—94.6%
——28——