Vulnerabilities exploitable today
407,708in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,767
New KEV · 24H0
Exploit Today ≥ 701,698
Distribution · last window
- Critical5,725
- High22,234
- Medium20,705
- Low2,166
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2017-16542—92.8%
——28——CVE-2021-24299—92.8%
——28——CVE-2014-8769—92.8%
——28——CVE-2005-1796—92.8%
——28——CVE-2017-0248—92.8%
——28——CVE-2013-5850—92.8%
——28——CVE-2015-0226—92.8%
——28——CVE-2017-5482—92.8%
——28——CVE-2016-0975—92.8%
——28——CVE-2004-0827—92.8%
——28——CVE-2002-1061—92.8%
——28——CVE-2022-29846—92.8%
——28——CVE-2024-54385—92.8%
——28——CVE-2017-0915—92.8%
——28——CVE-2016-0973—92.8%
——28——CVE-2001-0191—92.8%
——28——CVE-2019-7845—92.8%
——28——CVE-2015-1949—92.8%
——28——CVE-2023-3077—92.8%
——28——CVE-2017-15103—92.8%
——28——CVE-2024-484198.8 HIG92.8%
——28Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 suffers from Command Injection issues in /bin/goahead. Specifically, these issues can be triggered through /goform/tracerouteDiagnosis, /goform/pingDiagnosis, and /goform/fromSysToolPingCmd Each of these issues allows an attacker with access to the web interface to inject and execute arbitrary shell commands, with "root" privileges.122dCVE-2026-100606.3 MED92.8%
——28A vulnerability has been found in TRENDnet TEW-432BRP 3.10B20. This impacts the function formSetRoute of the file /goform/formSetRoute. The manipulation of the argument ip/mask/gateway leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.106dCVE-2025-341785.4 MED92.8%
——28In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.113dCVE-2016-1848—92.8%
——28——CVE-2013-3240—92.8%
——28——CVE-2025-55681—92.8%
——28——CVE-2014-1300—92.8%
——28——CVE-2014-8160—92.8%
——28——CVE-2005-3129—92.8%
——28——CVE-2015-6988—92.8%
——28——CVE-2021-30582—92.8%
——28——CVE-2008-5756—92.8%
——28——CVE-2020-7931—92.8%
——28——CVE-2026-28277—92.8%
——28——CVE-2015-2841—92.8%
——28——CVE-2016-4024—92.8%
——28——CVE-2005-4591—92.8%
——28——CVE-2016-3551—92.8%
——28——CVE-2007-1552—92.8%
——28——CVE-2013-1473—92.8%
——28——