Vulnerabilities exploitable today
376,337in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,713
New KEV · 24H0
Exploit Today ≥ 701,646
Distribution · last window
- Critical2,379
- High8,744
- Medium6,789
- Low727
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2010-5222—29.8%
——9——CVE-2026-30241—29.8%
——9——CVE-2006-0055—29.8%
——9——CVE-2026-56326—29.8%
——9——CVE-2005-2992—29.8%
——9——CVE-2004-0559—29.8%
——9——CVE-2004-0970—29.8%
——9——CVE-2004-1032—29.8%
——9——CVE-2017-9868—29.8%
——9——CVE-2005-2660—29.8%
——9——CVE-2020-0513—29.8%
——9——CVE-2022-45812—29.8%
——9——CVE-2025-46345—29.8%
——9——CVE-2023-41728—29.8%
——9——CVE-2025-11345—29.8%
——9——CVE-2016-3750—29.8%
——9——CVE-2023-23641—29.8%
——9——CVE-2023-23664—29.8%
——9——CVE-2025-0996—29.8%
——9——CVE-2023-37454—29.8%
——9——CVE-2026-354416.5 MED29.8%
——9Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus' GraphQL endpoints (/graphql and /graphql/system) did not deduplicate resolver invocations within a single request. An authenticated user could exploit GraphQL aliasing to repeat an expensive relational query many times in a single request, forcing the server to execute a large number of independent complex database queries concurrently, multiplying database load linearly with the number of aliases. The existing token limit on GraphQL queries still permitted enough aliases for significant resource exhaustion, while the relational depth limit applied per alias without reducing the total number executed. Rate limiting is disabled by default, meaning no built-in throttle prevented this from causing CPU, memory, and I/O exhaustion that could degrade or crash the service. Any authenticated user, including those with minimal read-only permissions, could trigger this condition. This vulnerability is fixed in 11.17.0.56dCVE-2023-29435—29.8%
——9——CVE-2017-5042—29.8%
——9——CVE-2026-692137.5 HIG29.8%
——9Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames through one unbounded queue consumed by writeLoop. When the peer stops reading, an unauthenticated HTTP/2 client can continue sending PING, SETTINGS, or DATA frames that cause Ember to enqueue acknowledgments or WINDOW_UPDATE frames faster than the writer drains them, exhausting heap memory on a server built with withHttp2. The shared behavior also affects an ember-client connected to a hostile HTTP/2 server, and the patch replaces the unbounded path with bounded, backpressured outbound queues. This issue is fixed in versions 0.23.35 and 1.0.0-M47.2dCVE-2023-23889—29.8%
——9——CVE-2023-23676—29.8%
——9——CVE-2025-31514—29.8%
——9——CVE-2026-892438.1 HIG29.8%
——9WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroup_name() that fails to sanitize group_name input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in the browser when other administrators access the user manager interface.7dCVE-2024-1185—29.8%
——9——CVE-2025-57616—29.8%
——9——CVE-2023-23894—29.8%
——9——CVE-2023-28534—29.8%
——9——CVE-2024-21994—29.8%
——9——CVE-2026-539084.3 MED29.8%
——9MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for valid and invalid users during username reminder and password reset operations. An attacker can leverage these differences to enumerate valid usernames and email addresses.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.74dCVE-2023-23873—29.8%
——9——CVE-2024-33938—29.8%
——9——CVE-2025-57612—29.8%
——9——CVE-2026-278835.0 MED29.8%
——9Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the `GET /api/v1/deployments/{uuid}` endpoint allows any authenticated user to access deployment details belonging to any team, bypassing team-based authorization. The $teamId is extracted from the authentication token but never used to scope the database query. This vulnerability is fixed in 4.0.0-beta.464.79dCVE-2026-24066.5 MED29.8%
——9Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client.
This issue affects Online Registration and Workflow Management System: through 12022026.44dCVE-2026-35623—29.8%
——9——