Vulnerabilities exploitable today
373,979in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,709
New KEV · 24H0
Exploit Today ≥ 701,644
Distribution · last window
- Critical2,324
- High8,430
- Medium6,377
- Low704
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-49211—25.2%
——8——CVE-2019-5302—25.2%
——8——CVE-2024-20153—25.2%
——8——CVE-2026-50637—25.2%
——8——CVE-2013-4677—25.2%
——8——CVE-2017-3166—25.2%
——8——CVE-2026-28920—25.2%
——8——CVE-2020-8152—25.2%
——8——CVE-2026-97486.5 MED25.2%
——8The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.54dCVE-2025-24159—25.2%
——8——CVE-2021-38260—25.2%
——8——CVE-2021-27768—25.2%
——8——CVE-2026-42083—25.2%
——8——CVE-2023-43275—25.2%
——8——CVE-2025-20180—25.2%
——8——CVE-2014-5029—25.2%
——8——CVE-2025-9681—25.2%
——8——CVE-2026-71492—25.2%
——8Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry.set() in src/banks/registries/directory.py interpolates attacker-controlled Prompt.name and Prompt.version values into a Path without canonicalization or containment validation. Relative traversal such as ../victim/foo and an absolute Prompt.name can escape or discard the configured registry root, while overwrite=True permits replacement of existing target files. The poisoned name is persisted in index.json and reconstructed by _load(), allowing the out-of-root path to survive later registry loads. An application that forwards request data into these fields can therefore write Prompt.raw bytes to attacker-chosen paths writable by the application process. This issue is fixed in version 2.4.5.26dCVE-2023-41868—25.2%
——8——CVE-2021-23879—25.2%
——8——CVE-2026-73207.5 HIG25.2%
——8Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.62dCVE-2026-566908.5 HIG25.2%
——8Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Information exposure, and Unauthorized access.61dCVE-2022-28651—25.2%
——8——CVE-2022-47069—25.2%
——8——CVE-2026-24685—25.2%
——8——CVE-1999-1430—25.2%
——8——CVE-2025-15220—25.2%
——8——CVE-2025-14660—25.2%
——8——CVE-2024-554886.5 MED25.2%
——8A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product level.72dCVE-2021-38258—25.2%
——8——CVE-2026-54833—25.2%
——8——CVE-2026-33220—25.2%
——8——CVE-2026-3511—25.2%
——8——CVE-2018-12209—25.2%
——8——CVE-2012-3738—25.2%
——8——CVE-2023-29117—25.2%
——8——CVE-2025-61940—25.2%
——8——CVE-2026-732586.5 MED25.2%
——8Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when either character resembles part of a CRLF terminator. This truncates headers, filenames, or boundaries and can cause an application to accept dangerous content after seeing a misleading Content-Type value. This issue is fixed in version 7.22.6dCVE-2026-634098.2 HIG25.2%
——8Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.296, a malicious Deskflow server can send an odd-length DSOP vector to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp, causing the missing value after the final option key to be read beyond the vector during the PacketStreamFilter::filterEvent to ServerProxy::handleData() to ServerProxy::parseHandshakeMessage() call chain and crash the connected client. This issue is fixed in continuous build 1.26.0.296.6dCVE-2019-5260—25.2%
——8——