Vulnerabilities exploitable today
406,192in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,766
New KEV · 24H0
Exploit Today ≥ 701,698
Distribution · last window
- Critical5,617
- High21,811
- Medium20,334
- Low2,108
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2020-11034—94.5%
——28——CVE-2014-01194.3 NO 94.5%
——28Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.17dCVE-2021-40469—94.5%
——28——CVE-2016-0030—94.5%
——28——CVE-2017-11249—94.5%
——28——CVE-2006-3811—94.5%
——28——CVE-2025-592469.8 CRI94.5%
——28Azure Entra ID Elevation of Privilege Vulnerability23dCVE-2013-2225—94.5%
——28——CVE-2017-11248—94.5%
——28——CVE-2017-7617—94.5%
——28——CVE-2004-1903—94.5%
——28——CVE-2024-4506—94.5%
——28——CVE-2018-4920—94.5%
——28——CVE-2020-9586—94.5%
——28——CVE-2002-2154—94.5%
——28——CVE-2004-0006—94.5%
——28——CVE-2004-0811—94.5%
——28——CVE-2025-345139.8 CRI94.5%
——28Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an OS command injection vulnerability in mbus_build_from_csv.php that allows an unauthenticated attacker to execute arbitrary code. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.22dCVE-2020-26147—94.5%
——28——CVE-2013-2556—94.5%
——28——CVE-2025-53786—94.5%
——28——CVE-2017-11246—94.5%
——28——CVE-2008-5541—94.5%
——28——CVE-2017-11265—94.5%
——28——CVE-2010-4769—94.5%
——28——CVE-2018-18955—94.5%
——28——CVE-2000-10165.0 NO 94.5%
——28The default configuration of Apache (httpd.conf) on SuSE 6.4 includes an alias for the /usr/doc directory, which allows remote attackers to read package documentation and obtain system configuration information via an HTTP request for the /doc/packages URL.38dCVE-2017-12163—94.5%
——28——CVE-2006-0328—94.5%
——28——CVE-2010-3456—94.5%
——28——CVE-2008-1762—94.5%
——28——CVE-2021-27708—94.5%
——28——CVE-1999-0561—94.5%
——28——CVE-2008-1761—94.5%
——28——CVE-2017-11233—94.5%
——28——CVE-2017-11232—94.5%
——28——CVE-2005-0339—94.5%
——28——CVE-2008-1411—94.5%
——28——CVE-2019-0537—94.5%
——28——CVE-2023-23416—94.5%
——28——