Vulnerabilities exploitable today
376,337in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,713
New KEV · 24H0
Exploit Today ≥ 701,646
Distribution · last window
- Critical2,383
- High8,771
- Medium6,812
- Low735
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2013-2239—28.9%
——9——CVE-2011-3257—28.9%
——9——CVE-2014-3486—28.9%
——9——CVE-2026-200128.6 HIG28.9%
——9A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition on an affected device.
This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device. A successful exploit of Cisco IOS Software and IOS XE Software could allow the attacker to cause the affected device to reload, resulting in a DoS condition. A successful exploit of Cisco Secure Firewall ASA Software and Secure FTD Software could allow the attacker to partially exhaust system memory, resulting in system instability, such as the inability to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition.4hCVE-2024-57369—28.9%
——9——CVE-2024-49513—28.9%
——9——CVE-2020-27614—28.9%
——9——CVE-2025-51606—28.9%
——9——CVE-2023-5021—28.9%
——9——CVE-2016-7601—28.9%
——9——CVE-2021-34267—28.9%
——9——CVE-2024-32695—28.9%
——9——CVE-2024-9670—28.9%
——9——CVE-2025-53593—28.9%
——9——CVE-2024-32533—28.9%
——9——CVE-2020-36833—28.9%
——9——CVE-2015-0926—28.9%
——9——CVE-2025-24976—28.9%
——9——CVE-2026-321474.3 MED28.9%
——9Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.
The SFTP daemon (ssh_sftpd) stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When SSH_FXP_FSETSTAT is issued on such a handle, file attributes (permissions, ownership, timestamps) are modified on the real filesystem path, bypassing the root directory boundary entirely.
Any authenticated SFTP user on a server configured with the root option can modify file attributes of files outside the intended chroot boundary. The prerequisite is that a target file must exist on the real filesystem at the same relative path. Note that this vulnerability only allows modification of file attributes; file contents cannot be read or altered through this attack vector.
If the SSH daemon runs as root, this enables direct privilege escalation: an attacker can set the setuid bit on any binary, change ownership of sensitive files, or make system configuration world-writable.
This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:do_open/4 and ssh_sftpd:handle_op/4.
This issue affects OTP from OTP 17.0 before OTP 28.4.3, OTP 27.3.4.11 and OTP 26.2.5.20, corresponding to ssh from 3.0.1 before 5.5.3, 5.2.11.7 and 5.1.4.15.55dCVE-2013-4763—28.9%
——9——CVE-2007-5159—28.9%
——9——CVE-2020-36834—28.9%
——9——CVE-2010-3435—28.9%
——9——CVE-2025-69606—28.9%
——9——CVE-2021-39794—28.9%
——9——CVE-2024-22311—28.9%
——9——CVE-2024-32544—28.9%
——9——CVE-2025-58600—28.9%
——9——CVE-2026-319274.9 MED28.9%
——9Anviz CX7 Firmware is vulnerable to an authenticated CSV upload which allows path traversal to overwrite arbitrary files (e.g., /etc/shadow), enabling unauthorized SSH access when combined with debug‑setting changes.69dCVE-2021-34268—28.9%
——9——CVE-2019-17340—28.9%
——9——CVE-2024-36735—28.9%
——9——CVE-2017-18240—28.9%
——9——CVE-2018-1992—28.9%
——9——CVE-2021-34261—28.9%
——9——CVE-2026-898498.8 HIG28.9%
——9In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
qla2x00_status_entry() filters out non-TYPE_SRB entries and the
SRB_NVME_CMD, SRB_BIDI_CMD and SRB_TM_CMD types, then falls through to a
SCSI fast path that assumes the command is an SRB_SCSI_CMD. The first
thing on that path, qla_chk_edif_rx_sa_delete_pending(), and the
subsequent handling both evaluate GET_CMD_SP(sp), i.e. sp->u.scmd.cmd.
The srb u union overlays the SCSI command pointer with other command
layouts (bsg_job, iocb_cmd). If firmware delivers an unexpected
STATUS_TYPE IOCB for a non-SCSI handle, sp->u.scmd.cmd can read as a
non-NULL garbage pointer, bypassing the NULL checks in
qla_chk_edif_rx_sa_delete_pending() and at the cp == NULL test, and
leading to a wild pointer dereference.
Reject any SRB whose type is not SRB_SCSI_CMD before entering the fast
path. The outstanding_cmds slot is left untouched so a genuinely
non-SCSI command still completes through its proper handler.1dCVE-2019-0120—28.9%
——9——CVE-2023-41037—28.9%
——9——CVE-2011-2494—28.9%
——9——CVE-2020-37142—28.9%
——9——