Vulnerabilities exploitable today
406,192in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,766
New KEV · 24H0
Exploit Today ≥ 701,698
Distribution · last window
- Critical5,605
- High21,775
- Medium20,307
- Low2,107
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2021-30195—94.5%
——28——CVE-2014-0538—94.5%
——28——CVE-2018-147209.8 CRI94.5%
——28FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.16dCVE-2011-2135—94.5%
——28——CVE-2012-4147—94.5%
——28——CVE-2026-1457—94.5%
——28——CVE-2012-4150—94.5%
——28——CVE-2017-6193—94.5%
——28——CVE-2007-1244—94.5%
——28——CVE-2024-9935—94.5%
——28——CVE-2007-1411—94.5%
——28——CVE-2004-1533—94.5%
——28——CVE-2012-4158—94.5%
——28——CVE-2018-19442—94.5%
——28——CVE-2005-0430—94.5%
——28——CVE-2023-34634—94.5%
——28——CVE-2009-1686—94.5%
——28——CVE-2012-4148—94.5%
——28——CVE-2018-7449—94.5%
——28——CVE-2008-0149—94.5%
——28——CVE-2025-95866.3 MED94.5%
——28A vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. Such manipulation of the argument mac leads to command injection. The attack may be performed from a remote location. The exploit is publicly available and might be used.36dCVE-2006-7128—94.5%
——28——CVE-2012-4155—94.5%
——28——CVE-1999-0467—94.5%
——28——CVE-2009-1807—94.5%
——28——CVE-2011-0538—94.5%
——28——CVE-2026-79756—94.5%
——28Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote() for the named-resource shell command path, but the list-all resource path (triggered when no specific resource name is provided) still interpolates the resourceNamespace parameter unquoted into a /bin/sh -c command string. An unauthenticated attacker can inject shell metacharacters via the X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace HTTP headers to achieve arbitrary command execution inside the dashboard container. This issue has been patched in version 1.17.4.58dCVE-2011-5002—94.5%
——28——CVE-2012-4159—94.5%
——28——CVE-2003-1432—94.5%
——28——CVE-2020-24639—94.5%
——28——CVE-2012-4151—94.5%
——28——CVE-2022-0658—94.5%
——28——CVE-2020-29599—94.5%
——28——CVE-2014-3634—94.5%
——28——CVE-2022-40946—94.5%
——28——CVE-2000-0162—94.5%
——28——CVE-2020-10973—94.5%
——28——CVE-2021-36075—94.5%
——28——CVE-2006-7157—94.5%
——28——