Vulnerabilities exploitable today
406,443in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,766
New KEV · 24H0
Exploit Today ≥ 701,698
Distribution · last window
- Critical5,571
- High21,547
- Medium20,115
- Low2,096
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-48455—93.6%
——28——CVE-2009-0243—93.6%
——28——CVE-2025-684777.7 HIG93.6%
——28Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, Langflow provides an API Request component that can issue arbitrary HTTP requests within a flow. This component takes a user-supplied URL, performs only normalization and basic format checks, and then sends the request using a server-side httpx client. It does not block private IP ranges (127[.]0[.]0[.]1, the 10/172/192 ranges) or cloud metadata endpoints (169[.]254[.]169[.]254), and it returns the response body as the result. Because the flow execution endpoints (/api/v1/run, /api/v1/run/advanced) can be invoked with just an API key, if an attacker can control the API Request URL in a flow, non-blind SSRF is possible—accessing internal resources from the server’s network context. This enables requests to, and collection of responses from, internal administrative endpoints, metadata services, and internal databases/services, leading to information disclosure and providing a foothold for further attacks. Version 1.7.0 contains a patch for this issue.20dCVE-2001-1457—93.6%
——28——CVE-2001-0778—93.6%
——28——CVE-2015-5589—93.6%
——28——CVE-2023-26600—93.6%
——28——CVE-2016-2173—93.6%
——28——CVE-2023-42820—93.6%
——28——CVE-2019-8928—93.6%
——28——CVE-2008-1497—93.6%
——28——CVE-2011-0814—93.6%
——28——CVE-2015-0326—93.6%
——28——CVE-2011-0561—93.6%
——28——CVE-2020-354908.1 HIG93.6%
——28FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.25dCVE-2014-0359—93.6%
——28——CVE-2014-9188—93.6%
——28——CVE-2009-0858—93.6%
——28——CVE-2016-1243—93.6%
——28——CVE-2024-45711—93.6%
——28——CVE-2017-7039—93.6%
——28——CVE-2022-28615—93.6%
——28——CVE-2019-8352—93.6%
——28——CVE-2024-29224—93.6%
——28——CVE-2021-24066—93.6%
——28——CVE-2025-53399—93.6%
——28In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or intercept RTP/SRTP media streams via RTP packets (except when the relay is configured for strict source and learning disabled). Version 13.4.1.1 fixes the heuristic mode by limiting exposure to the first five packets, and introduces a recrypt flag that fully prevents SRTP attacks when both mitigations are enabled.104dCVE-2025-5572—93.6%
——28——CVE-2018-8325—93.6%
——28——CVE-2006-2009—93.6%
——28——CVE-2010-0129—93.6%
——28——CVE-2017-8944—93.6%
——28——CVE-2005-3550—93.6%
——28——CVE-2015-1819—93.6%
——28——CVE-2013-6796—93.6%
——28——CVE-2013-5817—93.6%
——28——CVE-2019-17497—93.6%
——28——CVE-2002-0388—93.6%
——28——CVE-2008-4664—93.6%
——28——CVE-2020-6862—93.6%
——28——CVE-2018-1000804—93.6%
——28——