Vulnerabilities exploitable today
373,010in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,709
New KEV · 24H0
Exploit Today ≥ 701,644
Distribution · last window
- Critical2,219
- High8,127
- Medium6,187
- Low611
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-607927.4 HIG24.4%
——7Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).23dCVE-2026-347615.8 MED24.4%
——7Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, Ella Core panics when processing a NGAP handover failure message. An attacker able to cause a gNodeB to send NGAP handover failure messages to Ella Core can crash the process, causing service disruption for all connected subscribers. This issue has been patched in version 1.8.0.50dCVE-2026-2561—24.4%
——7——CVE-2025-10880—24.4%
——7——CVE-2024-9282—24.3%
——7——CVE-2023-38360—24.4%
——7——CVE-2020-3828—24.4%
——7——CVE-2025-8744—24.4%
——7——CVE-2023-46096—24.4%
——7——CVE-2026-274474.8 MED24.4%
——7OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon (cupsd) contains an authorization bypass vulnerability due to case-insensitive username comparison during authorization checks. The vulnerability allows an unprivileged user to gain unauthorized access to restricted operations by using a user with a username that differs only in case from an authorized user. At time of publication, there are no publicly available patches.50dCVE-2024-9584—24.4%
——7——CVE-2023-38271—24.4%
——7——CVE-2014-8535—24.4%
——7——CVE-2025-94979.8 CRI24.4%
——7Use of Hard-coded Credentials vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.0.31dCVE-2022-34556—24.4%
——7——CVE-2025-7473—24.4%
——7——CVE-2023-6845—24.4%
——7——CVE-2025-6056—24.4%
——7——CVE-2026-727778.6 HIG24.4%
——7Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to internal addresses, allowing them to reach arbitrary internal HTTP services and exfiltrate responses including cloud metadata.3dCVE-2025-60737—24.4%
——7——CVE-2024-30232—24.4%
——7——CVE-2025-2484—24.4%
——7——CVE-2021-47856—24.4%
——7——CVE-2025-2946—24.4%
——7——CVE-2022-50951—24.4%
——7——CVE-2014-0645—24.4%
——7——CVE-2023-53900—24.4%
——7——CVE-2024-53277—24.4%
——7——CVE-2025-12849—24.4%
——7——CVE-2025-2166—24.4%
——7——CVE-2026-2562—24.4%
——7——CVE-2026-609548.7 HIG24.4%
——7Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).23dCVE-2024-34126—24.4%
——7——CVE-2024-24839—24.4%
——7——CVE-2024-45307—24.4%
——7——CVE-2023-6956—24.4%
——7——CVE-2025-8415—24.4%
——7——CVE-2013-0399—24.4%
——7——CVE-2026-457674.4 MED24.4%
——7Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Preprocess `load`+ `save` rules to disallow absolute filenames for save, use Suricata's privilege dropping to limit writable files, and/or configure landlock in suricata.yaml.1dCVE-2026-710097.4 HIG24.4%
——7Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Commerce Guided Search / Oracle Commerce Experience Manager accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).19d