Vulnerabilities exploitable today
376,337in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,713
New KEV · 24H0
Exploit Today ≥ 701,646
Distribution · last window
- Critical2,382
- High8,758
- Medium6,800
- Low731
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2020-10690—29.5%
——9——CVE-2024-11682—29.5%
——9——CVE-2024-13509—29.5%
——9——CVE-2025-57907—29.5%
——9——CVE-2025-0511—29.5%
——9——CVE-2023-47070—29.5%
——9——CVE-2026-59730—29.5%
——9Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ (slash-backslash) were not recognized as internal paths, so the handler would echo the raw path back in the Location header. Because browsers treat \ as / per the WHATWG URL specification, the resulting redirect could resolve to an external host. Preconditions for exploitation: trailingSlash: 'always' must be set (non-default; the default is 'ignore'), the request path must not have a file extension in its final segment, and an attacker must deliver the crafted link to a user. This issue has been fixed in version 11.0.2.52dCVE-2014-6521—29.5%
——9——CVE-2025-67706—29.5%
——9——CVE-2024-12271—29.5%
——9——CVE-2023-51720—29.5%
——9——CVE-2010-0435—29.5%
——9——CVE-2025-46573—29.5%
——9——CVE-2024-1405—29.5%
——9——CVE-2007-3771—29.5%
——9——CVE-1999-0106—29.5%
——9——CVE-2024-33918—29.5%
——9——CVE-2025-15170—29.5%
——9——CVE-2023-45394—29.5%
——9——CVE-2024-41304—29.5%
——9——CVE-2013-0122—29.5%
——9——CVE-2025-62792—29.5%
——9——CVE-2022-28370—29.5%
——9——CVE-2023-51722—29.5%
——9——CVE-2023-7339—29.5%
——9——CVE-2026-50287—29.5%
——9——CVE-2026-57303—29.5%
——9——CVE-2023-52537—29.5%
——9——CVE-2018-1623—29.5%
——9——CVE-2026-46458—29.5%
——9ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential files are exposed via static HTTP. This allows an unauthenticated remote attacker to retrieve plaintext service account and SMTP credentials by requesting specific XML files from the webroot.
This issue has been fixed in version 2.4.18.02965dCVE-2020-26947—29.5%
——9——CVE-2025-27157—29.5%
——9——CVE-2006-5007—29.5%
——9——CVE-2001-0412—29.5%
——9——CVE-2017-1301—29.5%
——9——CVE-2024-11811—29.5%
——9——CVE-2016-1738—29.5%
——9——CVE-2026-3375—29.5%
——9——CVE-2024-48460—29.5%
——9——CVE-2023-41736—29.5%
——9——