Vulnerabilities exploitable today
406,443in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,766
New KEV · 24H0
Exploit Today ≥ 701,698
Distribution · last window
- Critical5,571
- High21,547
- Medium20,115
- Low2,096
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2016-1041—93.6%
——28——CVE-2021-23926—93.6%
——28——CVE-2016-1039—93.6%
——28——CVE-2014-9448—93.6%
——28——CVE-2015-7977—93.6%
——28——CVE-2006-0125—93.6%
——28——CVE-2001-1457—93.6%
——28——CVE-2018-12232—93.6%
——28——CVE-2008-1887—93.6%
——28——CVE-2017-5344—93.6%
——28——CVE-2010-4392—93.6%
——28——CVE-2008-0888—93.6%
——28——CVE-2026-425338.1 HIG93.6%
——28A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.84dCVE-2013-4797—93.6%
——28——CVE-2009-0250—93.6%
——28——CVE-2022-28615—93.6%
——28——CVE-2026-81118.8 HIG93.6%
——28SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.7dCVE-2019-8928—93.6%
——28——CVE-2017-7043—93.6%
——28——CVE-2006-4662—93.6%
——28——CVE-2008-0143—93.6%
——28——CVE-2010-4375—93.6%
——28——CVE-2024-6045—93.6%
——28——CVE-2020-111138.8 HIG93.6%
——28FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).69dCVE-2006-1858—93.6%
——28——CVE-2018-3615—93.6%
——28——CVE-2006-1546—93.6%
——28——CVE-2018-1000804—93.6%
——28——CVE-2024-45711—93.6%
——28——CVE-2024-29224—93.6%
——28——CVE-2016-2173—93.6%
——28——CVE-2023-42820—93.6%
——28——CVE-2005-1006—93.6%
——28——CVE-2018-6237—93.6%
——28——CVE-2014-9188—93.6%
——28——CVE-2007-6593—93.6%
——28——CVE-2022-1940—93.6%
——28——CVE-2015-8654—93.6%
——28——CVE-2014-4018—93.6%
——28——CVE-2006-2009—93.6%
——28——