Vulnerabilities exploitable today
4,330in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,748
New KEV · 24H0
Exploit Today ≥ 701,665
Distribution · last window
- Critical3,340
- High15,177
- Medium14,103
- Low1,353
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2017-12542—99.9%
——30——CVE-2018-12998—99.9%
——30——CVE-2023-23333—99.9%
——30——CVE-2024-4885—99.9%
KEV—80Progress WhatsUp Gold Path Traversal Vulnerability—CVE-2023-28771—99.9%
KEV—80Zyxel Multiple Firewalls OS Command Injection Vulnerability—CVE-2020-19389.8 CRI99.9%
KEV—80Apache Tomcat Improper Privilege Management Vulnerability56dCVE-2020-14750—99.9%
KEV—80Oracle WebLogic Server Remote Code Execution Vulnerability—CVE-2022-303337.5 HIG99.9%
KEVR80RARLAB UnRAR Directory Traversal Vulnerability18dCVE-2017-01448.8 HIG99.9%
KEVR80Microsoft SMBv1 Remote Code Execution Vulnerability67dCVE-2025-29927—99.9%
——30——CVE-2023-22515—99.9%
KEVR80Atlassian Confluence Data Center and Server Broken Access Control Vulnerability—CVE-2020-0646—99.9%
KEV—80Microsoft .NET Framework Remote Code Execution Vulnerability—CVE-2020-11022—99.9%
——30——CVE-2024-27348—99.9%
KEV—80Apache HugeGraph-Server Improper Access Control Vulnerability—CVE-2020-36289—99.9%
——30——CVE-2022-24086—99.9%
KEV—80Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability—CVE-2020-11978—99.9%
KEV—80Apache Airflow Command Injection—CVE-2022-36804—99.9%
KEV—80Atlassian Bitbucket Server and Data Center Command Injection Vulnerability—CVE-2018-76029.8 CRI99.9%
KEVR80Drupal Core Remote Code Execution Vulnerability18dCVE-2022-301907.8 HIG99.9%
KEVR80Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability75dCVE-2022-40300—99.9%
——30——CVE-2021-445299.8 CRI99.9%
KEVR80Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability 77dCVE-2025-497066.5 MED99.9%
KEVR80Microsoft SharePoint Improper Authentication Vulnerability77dCVE-2020-10199—99.9%
KEV—80Sonatype Nexus Repository Remote Code Execution Vulnerability—CVE-2015-1538—99.9%
——30——CVE-2022-39986—99.9%
——30——CVE-2022-24637—99.9%
——30——CVE-2020-06188.8 HIG99.9%
KEVR80Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability66dCVE-2019-16278—99.9%
KEV—80Nostromo nhttpd Directory Traversal Vulnerability—CVE-2014-01147.5 NO 99.9%
——30Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.6dCVE-2021-21978—99.9%
——30——CVE-2021-25646—99.9%
——30——CVE-2025-686139.9 CRI99.9%
KEV—80n8n Improper Control of Dynamically-Managed Code Resources Vulnerability7dCVE-2026-240619.8 CRI99.9%
KEV—80GNU InetUtils Argument Injection Vulnerability20dCVE-2020-7247—99.9%
KEV—80OpenSMTPD Remote Code Execution Vulnerability—CVE-2025-49113—99.9%
KEV—80RoundCube Webmail Deserialization of Untrusted Data Vulnerability—CVE-2021-40539—99.9%
KEVR80Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability—CVE-2019-3929—99.9%
KEV—80Crestron Multiple Products Command Injection Vulnerability—CVE-2017-3881—99.9%
KEV—80Cisco IOS and IOS XE Remote Code Execution Vulnerability—CVE-2011-3192—99.9%
——30——