Vulnerabilities exploitable today
406,443in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,766
New KEV · 24H0
Exploit Today ≥ 701,698
Distribution · last window
- Critical5,571
- High21,547
- Medium20,115
- Low2,096
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2007-6537—93.6%
——28——CVE-2004-1307—93.6%
——28——CVE-2006-1495—93.6%
——28——CVE-2001-0778—93.6%
——28——CVE-2016-8741—93.6%
——28——CVE-2013-4797—93.6%
——28——CVE-2020-363278.8 HIG93.6%
——28Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.25dCVE-2005-3550—93.6%
——28——CVE-2025-53399—93.6%
——28In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or intercept RTP/SRTP media streams via RTP packets (except when the relay is configured for strict source and learning disabled). Version 13.4.1.1 fixes the heuristic mode by limiting exposure to the first five packets, and introduces a recrypt flag that fully prevents SRTP attacks when both mitigations are enabled.104dCVE-2011-1918—93.6%
——28——CVE-2015-5589—93.6%
——28——CVE-2017-8944—93.6%
——28——CVE-2022-28615—93.6%
——28——CVE-2008-5885—93.6%
——28——CVE-2024-29224—93.6%
——28——CVE-2013-3060—93.6%
——28——CVE-2020-111138.8 HIG93.6%
——28FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).69dCVE-2002-0388—93.6%
——28——CVE-2006-1546—93.6%
——28——CVE-2009-0858—93.6%
——28——CVE-2018-12232—93.6%
——28——CVE-2026-81118.8 HIG93.6%
——28SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.7dCVE-2019-17497—93.6%
——28——CVE-2025-543535.4 MED93.6%
——28An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an attacker to perform an XSS attack via crafted HTTP requests.25dCVE-2008-4664—93.6%
——28——CVE-2017-5344—93.6%
——28——CVE-2005-3389—93.6%
——28——CVE-2025-60724—93.6%
——28——CVE-2005-1006—93.6%
——28——CVE-2017-11939—93.6%
——28——CVE-2013-5782—93.6%
——28——CVE-2015-8652—93.6%
——28——CVE-2018-17958—93.6%
——28——CVE-2018-10286—93.6%
——28——CVE-2014-9188—93.6%
——28——CVE-2011-0560—93.6%
——28——CVE-2020-0880—93.6%
——28——CVE-2012-5324—93.6%
——28——CVE-2018-6237—93.6%
——28——CVE-2011-0814—93.6%
——28——