Vulnerabilities exploitable today
407,791in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,767
New KEV · 24H0
Exploit Today ≥ 701,698
Distribution · last window
- Critical5,677
- High22,160
- Medium20,661
- Low2,175
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2013-1669—92.7%
——28——CVE-2015-3310—92.7%
——28——CVE-2007-1260—92.7%
——28——CVE-2008-5528—92.7%
——28——CVE-2007-5081—92.7%
——28——CVE-2013-5932—92.7%
——28——CVE-2017-17970—92.7%
——28——CVE-2026-614506.5 MED92.7%
——28Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author (any admin.pages user, or anyone able to write to user/pages) to exfiltrate configuration secrets. Although the sandbox replaces the 'config' variable with a redacted facade and strips Config::get/toArray from the method allowlist, the raw container remains accessible via the allow-listed grav.offsetGet('config'), which returns the real Config object. Allow-listed object-dumping filters (json_encode, print_r, yaml_encode) then serialize that object at the PHP level without invoking the sandbox method gate, exposing the full config tree including plugin secrets such as SMTP credentials, API keys, and plugin DB credentials. This is an incomplete fix for GHSA-j274-39qw-32c9.10dCVE-2021-34993—92.7%
——28——CVE-2020-13252—92.7%
——28——CVE-2015-0797—92.7%
——28——CVE-2005-1248—92.7%
——28——CVE-2008-4452—92.7%
——28——CVE-2022-439457.5 HIG92.7%
——28The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H21dCVE-2016-7626—92.7%
——28——CVE-2008-3303—92.7%
——28——CVE-2018-7046—92.7%
——28——CVE-2013-2727—92.7%
——28——CVE-2012-3960—92.7%
——28——CVE-2020-14364—92.7%
——28——CVE-2012-0200—92.7%
——28——CVE-2012-5678—92.7%
——28——CVE-2016-3068—92.7%
——28——CVE-2019-2557—92.7%
——28——CVE-2013-3622—92.7%
——28——CVE-2010-1750—92.7%
——28——CVE-2026-1112247.5 HIG92.7%
——28pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.19dCVE-2009-0953—92.7%
——28——CVE-2015-8027—92.7%
——28——CVE-2002-1365—92.7%
——28——CVE-2008-0528—92.7%
——28——CVE-2021-36050—92.7%
——28——CVE-2015-6544—92.7%
——28——CVE-2008-2305—92.7%
——28——CVE-2013-3328—92.7%
——28——CVE-2015-3245—92.7%
——28——CVE-2021-3190—92.7%
——28——CVE-2020-9410—92.7%
——28——CVE-2008-0337—92.7%
——28——CVE-2009-1119—92.7%
——28——