Vulnerabilities exploitable today
377,896in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,716
New KEV · 24H0
Exploit Today ≥ 701,651
Distribution · last window
- Critical2,337
- High8,543
- Medium6,730
- Low747
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-203448.8 HIG31.1%
——9A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have a valid account on the device with the role of Security Approver, Access Admin, or Network Admin.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain any data from the database, obtain the session credentials of an authenticated Administrator, and take actions with administrative privileges on the affected device.2dCVE-2023-24304—31.1%
——9——CVE-2026-5967—31.1%
——9——CVE-2023-35177—31.1%
——9——CVE-2026-454577.8 HIG31.1%
——9Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally.59dCVE-2025-0643—31.1%
——9——CVE-2023-41134—31.1%
——9——CVE-2026-456457.8 HIG31.1%
——9Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.59dCVE-2025-69045—31.1%
——9——CVE-2023-2878—31.1%
——9——CVE-2024-30200—31.1%
——9——CVE-2013-1919—31.1%
——9——CVE-2021-0086—31.1%
——9——CVE-2023-34156—31.1%
——9——CVE-2025-54880—31.1%
——9——CVE-2014-0199—31.1%
——9——CVE-2025-31135—31.1%
——9——CVE-2023-29368—31.1%
——9——CVE-2010-4211—31.1%
——9——CVE-2022-33889—31.1%
——9——CVE-2023-51542—31.1%
——9——CVE-2025-27236—31.1%
——9——CVE-2026-40914—31.1%
——9——CVE-2023-51740—31.1%
——9——CVE-2022-46693—31.1%
——9——CVE-2007-0866—31.1%
——9——CVE-2024-37279—31.1%
——9——CVE-2006-4248—31.1%
——9——CVE-2025-27581—31.1%
——9——CVE-2026-145877.5 HIG31.1%
——9Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for more bytes instead of rejecting the protocol message and closing the channel.
Because the same unread bytes remain at the front of the decoder buffer, appending a terminating byte later does not recover the connection. The decoder re-reads the same first 32 continuation bytes, returns without producing a handshake-finalization message, and leaves the channel open.
This can be triggered before authentication by any client that can reach the Bolt connector.22dCVE-2018-1652—31.1%
——9——CVE-2005-3286—31.1%
——9——CVE-2026-66658.1 HIG31.1%
——9The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.58dCVE-2026-73569—31.1%
——9fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.1dCVE-2026-278347.2 HIG31.1%
——9Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.57dCVE-2025-0426—31.1%
——9——CVE-2026-34604—31.1%
——9——CVE-2022-37405—31.1%
——9——CVE-2026-5207—31.1%
——9——CVE-2016-10088—31.1%
——9——