Vulnerabilities exploitable today
406,192in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,766
New KEV · 24H0
Exploit Today ≥ 701,698
Distribution · last window
- Critical5,605
- High21,775
- Medium20,307
- Low2,107
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2012-4158—94.5%
——28——CVE-2020-29599—94.5%
——28——CVE-2015-8158—94.5%
——28——CVE-2007-1244—94.5%
——28——CVE-2023-271676.5 MED94.5%
——28Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?search_month=1.115dCVE-2005-0430—94.5%
——28——CVE-2003-1432—94.5%
——28——CVE-2020-17388—94.5%
——28——CVE-2009-4212—94.5%
——28——CVE-2026-79756—94.5%
——28Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote() for the named-resource shell command path, but the list-all resource path (triggered when no specific resource name is provided) still interpolates the resourceNamespace parameter unquoted into a /bin/sh -c command string. An unauthenticated attacker can inject shell metacharacters via the X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace HTTP headers to achieve arbitrary command execution inside the dashboard container. This issue has been patched in version 1.17.4.58dCVE-2014-3634—94.5%
——28——CVE-2014-8118—94.5%
——28——CVE-2012-4153—94.5%
——28——CVE-2019-8558—94.5%
——28——CVE-2026-1457—94.5%
——28——CVE-2007-2241—94.5%
——28——CVE-2018-11796—94.5%
——28——CVE-2025-95866.3 MED94.5%
——28A vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. Such manipulation of the argument mac leads to command injection. The attack may be performed from a remote location. The exploit is publicly available and might be used.36dCVE-2024-8897—94.5%
——28——CVE-2026-56274—94.5%
——28——CVE-2024-9935—94.5%
——28——CVE-2017-9120—94.5%
——28——CVE-2011-4369—94.5%
——28——CVE-2007-2974—94.5%
——28——CVE-2017-6193—94.5%
——28——CVE-2018-7449—94.5%
——28——CVE-2002-1905—94.5%
——28——CVE-2005-0614—94.5%
——28——CVE-2012-4155—94.5%
——28——CVE-2008-5680—94.5%
——28——CVE-2015-0227—94.5%
——28——CVE-2008-5753—94.5%
——28——CVE-2011-4644—94.5%
——28——CVE-2022-0993—94.5%
——28——CVE-2006-2483—94.5%
——28——CVE-2017-6549—94.5%
——28——CVE-2004-1664—94.5%
——28——CVE-2016-98419.8 CRI94.5%
——28inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.23dCVE-1999-0467—94.5%
——28——CVE-2002-0892—94.5%
——28——