Vulnerabilities exploitable today
373,224in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,709
New KEV · 24H0
Exploit Today ≥ 701,644
Distribution · last window
- Critical2,252
- High8,221
- Medium6,136
- Low670
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-11485—24.8%
——7——CVE-2025-7856—24.8%
——7——CVE-2026-8208—24.8%
——7Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interpretation of a user provided .zip as PHP. Successful exploitation requires Teacher or higher privileges. Exploitation could result in compromise of the underlying web server.52dCVE-2024-29908—24.8%
——7——CVE-2025-3422—24.8%
——7——CVE-2025-55228—24.8%
——7——CVE-2024-32536—24.8%
——7——CVE-2026-40811—24.8%
——7——CVE-2021-35599—24.8%
——7——CVE-2026-24729—24.8%
——7——CVE-2025-28985—24.8%
——7——CVE-2025-27405—24.8%
——7——CVE-2026-40818—24.8%
——7——CVE-2025-3157—24.8%
——7——CVE-2025-47526—24.8%
——7——CVE-2023-21220—24.8%
——7——CVE-2026-822656.5 MED24.8%
——7Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify log levels to suppress logging.14dCVE-2026-54079—24.8%
——7veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the getdynamicRender() method, where a crafted PDF containing a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation and allow local file disclosure or outbound server-side requests. This issue is fixed in versions 1.30.2 and 1.31.71.46dCVE-2026-40816—24.8%
——7——CVE-2025-24778—24.8%
——7——CVE-2026-32880—24.8%
——7——CVE-2026-591355.5 MED24.8%
——7Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.29dCVE-2019-25568—24.8%
——7——CVE-2024-12495—24.8%
——7——CVE-2025-46489—24.8%
——7——CVE-2026-50666.3 MED24.8%
——7A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c). When the TLS session cache is enabled, tls_session_store() and tls_session_restore() memcpy the caller-supplied address into a fixed-size buffer using the caller-controlled addrlen value without validating it against the destination size. struct net_sockaddr is an opaque type, so an application can pass an addrlen larger than sizeof(struct net_sockaddr) (for example 128 bytes into a 24-byte stack buffer), causing the memcpy to read and write past the end of the address memory used by the TLS session cache. This out-of-bounds write can lead to a crash and denial of service, and potentially to arbitrary code execution.53dCVE-2026-66008—24.8%
——7Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled (graphQLPublicIntrospection: false, the default). Because these errors are produced before authentication, authorization, or any resolver runs, an unauthenticated client possessing only the public application ID can trigger errors on Pointer or Relation fields to reconstruct hidden schema class names, partially defeating the schema-hiding protection. Only schema metadata (class names) is exposed; no object data, credentials, or user records are disclosed.48dCVE-2024-32579—24.8%
——7——CVE-2025-66719—24.8%
——7——CVE-2024-27991—24.8%
——7——CVE-2026-23521—24.8%
——7——CVE-2024-32530—24.8%
——7——CVE-2024-32561—24.8%
——7——CVE-2025-47469—24.8%
——7——CVE-2025-39457—24.8%
——7——CVE-2010-2427—24.8%
——7——CVE-2019-1603—24.8%
——7——CVE-2026-81856.3 MED24.8%
——7A security vulnerability has been detected in UGREEN CM933 1.1.59.4319. The impacted element is an unknown function of the component Administrative Interface. Such manipulation leads to missing authentication. The attack requires being on the local network. You should upgrade the affected component. The vendor replied: "We have successfully confirmed and reproduced the issue. We take this matter very seriously and have incorporated the fix into our development schedule. The issue is scheduled to be resolved in the release version coming in late April."52dCVE-2024-30931—24.8%
——7——CVE-2025-11060—24.8%
——7——