Vulnerabilities exploitable today
378,026in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,716
New KEV · 24H0
Exploit Today ≥ 701,651
Distribution · last window
- Critical2,293
- High8,410
- Medium6,691
- Low753
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2016-5499—31.6%
——9——CVE-2024-9202—31.6%
——9——CVE-2022-48515—31.6%
——9——CVE-2002-2128—31.6%
——9——CVE-2024-50554—31.6%
——9——CVE-2026-478668.3 HIG31.6%
——9VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization.
Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
30.1.1 through 30.2.6 (fixed in 30.2.7)
22.1.1 through 22.1.7 (fixed in 30.2.7)32dCVE-2025-15454—31.6%
——9——CVE-2024-6692—31.6%
——9——CVE-2012-4443—31.6%
——9——CVE-2025-12276—31.6%
——9——CVE-2026-61599—31.6%
——9djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling `__import__(module_path, ...)`. The module is imported — running its top-level code (import side effects) — before the framework checks that the resolved object is a `LiveView` subclass and before any per-view authentication. The `LIVEVIEW_ALLOWED_MODULES` allowlist that should contain this is fail-open (`if allowed_modules:` — skipped when the setting is unset, the framework default) and uses loose `startswith` matching. An unauthenticated WebSocket client (the WS handshake does not require auth; per-view auth runs only after import + instantiate) can therefore send a `mount` / `live_redirect_mount` / `url_change` frame (or an SSE mount) with `view = "<any.importable.module>.AnyName"` and cause the server to import — and execute the top-level code of — any importable Python module by name. Version 1.0.7 fixes the issue with a fail-closed resolution gate (`djust._view_resolution.is_view_import_allowed`): a client view path resolves only if (a) its module is already loaded (`sys.modules` — so resolving runs no new code; URL-routed views loaded by URLconf at startup keep working with zero config) or (b) it matches `LIVEVIEW_ALLOWED_MODULES` on a module-segment boundary (explicit opt-in for lazily-imported views). The gate runs before `__import__` at all three sinks (+ defense-in-depth inside `_instantiate_view`). As a workaround, set `LIVEVIEW_ALLOWED_MODULES` to the narrow list of modules that contain your mountable LiveView classes. (Note: pre-patch the allowlist is `startswith`-matched and the import still precedes the subclass check, so this is mitigation, not a complete fix.)4dCVE-2026-590927.7 HIG31.6%
——9JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. Attackers can request the /debug/pprof/cmdline endpoint to obtain the process command line containing metadata engine connection strings with database credentials, granting full read/write access to filesystem metadata, while other pprof handlers leak internal state and profiling handlers enable denial of service.35dCVE-2003-1062—31.6%
——9——CVE-2026-30244—31.6%
——9——CVE-2025-1670—31.6%
——9——CVE-2006-0965—31.6%
——9——CVE-2019-11162—31.6%
——9——CVE-2024-8536—31.6%
——9——CVE-2024-45712—31.6%
——9——CVE-2022-433408.8 HIG31.6%
——9A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular users.74dCVE-2024-45713—31.6%
——9——CVE-2024-40633—31.6%
——9——CVE-2015-5961—31.6%
——9——CVE-2012-3203—31.6%
——9——CVE-2026-635257.8 HIG31.6%
——9Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code locally.39dCVE-2021-1059—31.6%
——9——CVE-2024-39132—31.6%
——9——CVE-2026-42234—31.6%
——9——CVE-2024-8239—31.6%
——9——CVE-2026-624345.3 MED31.6%
——9A guest started with Populated on Demand enabled (PoD) can attempt to
reclaim pages which aren't regular guest RAM. This can cause corruption
of memory management state in Xen.55dCVE-2026-33330—31.6%
——9——CVE-2024-51827—31.6%
——9——CVE-2024-11763—31.6%
——9——CVE-2026-421836.5 MED31.6%
——9Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization() causes a panic (denial of service) for SSO users whose claims match a namespace-level RBAC rule but not an SSO-namespace rule, when SSO_DELEGATE_RBAC_TO_NAMESPACE=true. This issue has been patched in version 4.0.5.58dCVE-2026-872117.5 HIG31.6%
——9Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).3dCVE-2020-13362—31.6%
——9——CVE-2025-43419—31.6%
——9——CVE-2023-50008—31.6%
——9——CVE-2026-325497.5 HIG31.6%
——9Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.32dCVE-2026-7089—31.6%
——9——