Vulnerabilities exploitable today
378,631in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,721
New KEV · 24H0
Exploit Today ≥ 701,652
Distribution · last window
- Critical2,396
- High8,640
- Medium6,936
- Low787
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-34018—33.8%
——10——CVE-2026-732569.1 CRI33.8%
——10Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in src/http.c tests hm.proto.len with an impossible greater-than-eight condition even though mg_http_parse() requires an eight-byte protocol string, so is_http_1_0 is never set. Mongoose consequently processes chunked encoding that an HTTP/1.0 proxy can ignore, enabling request smuggling and unauthorized access or state changes. This issue is fixed in version 7.22.13dCVE-2023-27150—33.8%
——10——CVE-2024-8283—33.8%
——10——CVE-2026-6432—33.8%
——10——CVE-2024-29923—33.8%
——10——CVE-2024-34696—33.8%
——10——CVE-2026-367997.5 HIG33.8%
——10Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a buffer overflow in the portalAuth parameter of the formPortalAuth function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.62dCVE-2026-711077.5 HIG33.7%
——10Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).29dCVE-2021-29757—33.7%
——10——CVE-2017-16996—33.7%
——10——CVE-2025-52732—33.7%
——10——CVE-2010-4655—33.7%
——10——CVE-2025-5784—33.7%
——10——CVE-2026-32367—33.7%
——10——CVE-2020-14378—33.7%
——10——CVE-1999-1186—33.7%
——10——CVE-2023-30528—33.7%
——10——CVE-2022-24448—33.7%
——10——CVE-2026-20693—33.7%
——10——CVE-2023-36473—33.7%
——10——CVE-2018-5073—33.7%
——10——CVE-2026-31283—33.7%
——10——CVE-2026-479958.1 HIG33.7%
——10Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.26dCVE-2024-27952—33.7%
——10——CVE-2026-39951—33.7%
——10——CVE-2025-32808—33.7%
——10——CVE-2026-442219.0 CRI33.7%
——10ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contributed: (1) ServerSecurityUser.getDatabaseUser() returned a DB user with an uninitialized fileAccessMap, which requestAccessOnFile treated as allow-all; (2) ArcadeDBServer.createDatabase() omitted factory.setSecurity(...) so any database created via POST /api/v1/server {"command":"create database X"} had its entire record-level authorization system silently disabled. In combination, record-level and database-level authorization could be bypassed by any authenticated principal. This vulnerability is fixed in 26.4.2.50dCVE-2026-0869—33.7%
——10——CVE-2026-425707.5 HIG33.7%
——10Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.29dCVE-2010-3859—33.7%
——10——CVE-2024-56273—33.7%
——10——CVE-2026-3483—33.7%
——10——CVE-2020-4938—33.7%
——10——CVE-2024-30201—33.7%
——10——CVE-2025-5557—33.7%
——10——CVE-2025-5546—33.7%
——10——CVE-2023-43971—33.7%
——10——CVE-2023-23816—33.7%
——10——CVE-2023-34087—33.7%
——10——