Vulnerabilities exploitable today
374,073in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,710
New KEV · 24H0
Exploit Today ≥ 701,645
Distribution · last window
- Critical2,342
- High8,460
- Medium6,415
- Low712
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-44335—25.7%
——8——CVE-2024-45670—25.7%
——8——CVE-2026-855847.5 HIG25.7%
——8SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated authentication requests with unique invalid usernames to exhaust memory and increase synchronization overhead, degrading service availability.7dCVE-2021-22775—25.7%
——8——CVE-2021-28708—25.7%
——8——CVE-2025-67956—25.7%
——8——CVE-2026-30903—25.7%
——8——CVE-2022-40722—25.7%
——8——CVE-2002-0805—25.7%
——8——CVE-2023-38624—25.7%
——8——CVE-2006-0762—25.7%
——8——CVE-2024-51542—25.7%
——8——CVE-2025-8711—25.7%
——8——CVE-2020-1666—25.7%
——8——CVE-2025-31062—25.7%
——8——CVE-2023-47077—25.7%
——8——CVE-2023-44331—25.7%
——8——CVE-2004-0971—25.7%
——8——CVE-2006-5406—25.7%
——8——CVE-2017-5736—25.7%
——8——CVE-2002-1972—25.7%
——8——CVE-2023-28700—25.7%
——8——CVE-2026-30534—25.7%
——8——CVE-2012-4112—25.7%
——8——CVE-2005-2944—25.7%
——8——CVE-2023-26924—25.7%
——8——CVE-2023-44333—25.7%
——8——CVE-2020-2314—25.7%
——8——CVE-2023-5523—25.7%
——8——CVE-2026-83618—25.7%
——8xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteral_match and SystemLiteral_match expressions produced by reg() in lib/grammar.js, which inherit the multiline flag. A complete valid literal on the first line can therefore satisfy the matcher while U+000A, U+000D, U+2028, or U+2029 and breakout markup remain in the emitted <!DOCTYPE ...> declaration. This bypasses the strict-serialization mitigation for the earlier DocumentType injection advisory; creation and direct property assignment remain unvalidated by design. This issue is fixed in @xmldom/xmldom version 0.9.12.7dCVE-2024-5945—25.7%
——8——CVE-2024-55270—25.7%
——8——CVE-2024-21264—25.7%
——8——CVE-2025-62661—25.7%
——8——CVE-2026-451037.5 HIG25.7%
——8OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned int (e.g., 4294967296), the framing layer computes a wrapped-around value (e.g., 0) and splits the TCP stream at the wrong boundary, causing the body of the first SIP message to be processed as a separate message and enabling SIP message smuggling. Because Content-Length is parsed in the transport layer before authentication, an unauthenticated, network-based attacker can smuggle arbitrary SIP messages over any TCP-based transport (proto_tcp, proto_tls, proto_ws, proto_wss) on any instance with TCP enabled, with no routing-script preconditions. This allows smuggled messages to bypass front-end SBC/proxy security policies, inherit the connection's authentication context, and evade rate limiting. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.7dCVE-2026-27753—25.7%
——8——CVE-2026-488799.8 CRI25.7%
——8Incorrect Privilege Assignment vulnerability in Sergey AIWU allows Privilege Escalation.
This issue affects AIWU: from n/a through 1.4.17.55dCVE-2026-25479—25.7%
——8——CVE-2020-3881—25.7%
——8——CVE-2026-603974.3 MED25.7%
——8Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle GoldenGate executes to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GoldenGate. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).46d