Vulnerabilities exploitable today
407,791in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,767
New KEV · 24H0
Exploit Today ≥ 701,698
Distribution · last window
- Critical5,689
- High22,180
- Medium20,669
- Low2,176
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2008-0033—92.7%
——28——CVE-2019-97406.1 MED92.7%
——28An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.21dCVE-2013-3622—92.7%
——28——CVE-2014-4909—92.7%
——28——CVE-2012-0200—92.7%
——28——CVE-2016-0703—92.7%
——28——CVE-2002-0328—92.7%
——28——CVE-2009-1180—92.7%
——28——CVE-2024-32739—92.7%
——28——CVE-2013-1702—92.7%
——28——CVE-2019-1023—92.7%
——28——CVE-2011-2139—92.7%
——28——CVE-2013-4560—92.7%
——28——CVE-2017-10622—92.7%
——28——CVE-2015-10137—92.7%
——28——CVE-2026-444967.5 HIG92.7%
——28Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the affected browser tab while axios prepares a request. The issue does not affect ordinary Node.js HTTP adapter usage, React Native, or web workers, where axios does not read document.cookie. This vulnerability is fixed in 0.32.0 and 1.16.0.54dCVE-2021-24226—92.7%
——28——CVE-2006-1592—92.7%
——28——CVE-2012-1682—92.7%
——28——CVE-2026-328547.5 HIG92.7%
——28LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.113dCVE-2023-28769—92.7%
——28——CVE-2012-5678—92.7%
——28——CVE-2008-5705—92.7%
——28——CVE-2017-11770—92.7%
——28——CVE-2007-1260—92.7%
——28——CVE-2019-0819—92.7%
——28——CVE-2008-3303—92.7%
——28——CVE-2008-0074—92.7%
——28——CVE-2007-0770—92.7%
——28——CVE-2002-0508—92.7%
——28——CVE-2011-1553—92.7%
——28——CVE-2019-0990—92.7%
——28——CVE-2019-2557—92.7%
——28——CVE-2016-0860—92.7%
——28——CVE-2008-1187—92.7%
——28——CVE-2009-2336—92.7%
——28——CVE-2022-25167—92.7%
——28——CVE-2013-5573—92.7%
——28——CVE-2016-6295—92.7%
——28——CVE-2001-0288—92.7%
——28——