Vulnerabilities exploitable today
401,106in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,665
Distribution · last window
- Critical3,479
- High15,806
- Medium14,767
- Low1,460
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2007-5423—99.5%
——30——CVE-2021-2394—99.5%
——30——CVE-2023-368998.8 HIG99.5%
——30ASP.NET Elevation of Privilege Vulnerability72dCVE-2023-29509—99.5%
——30——CVE-2023-29524—99.5%
——30——CVE-2020-8863—99.5%
——30——CVE-2018-9160—99.5%
——30——CVE-2022-1179—99.5%
——30——CVE-2014-7141—99.5%
——30——CVE-2021-213466.1 MED99.5%
——30XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.14dCVE-2022-26937—99.5%
——30——CVE-2007-0940—99.5%
——30——CVE-2013-1391—99.5%
——30——CVE-2024-41730—99.5%
——30——CVE-2022-45699—99.5%
——30——CVE-2017-1092—99.5%
——30——CVE-2023-35885—99.5%
——30——CVE-2012-1182—99.5%
——30——CVE-2025-8943—99.5%
——30——CVE-2019-12255—99.5%
——30——CVE-2019-1439—99.5%
——30——CVE-2020-25540—99.5%
——30——CVE-2022-22274—99.5%
——30——CVE-2018-7700—99.5%
——30——CVE-2018-19300—99.5%
——30——CVE-2023-32243—99.5%
——30——CVE-2023-49085—99.5%
——30——CVE-2010-3653—99.5%
——30——CVE-2015-0779—99.5%
——30——CVE-2016-1561—99.5%
——30——CVE-2013-3336—99.5%
——30——CVE-2013-2115—99.5%
——30——CVE-2004-2086—99.5%
——30——CVE-2019-11248—99.5%
——30——CVE-2022-0169—99.5%
——30——CVE-2025-117499.8 CRI99.5%
——30The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract the bearer token, which can be used to gain access to a valid session and perform many actions like creating a new administrator account, leading to privilege escalation.3dCVE-2005-0116—99.5%
——30——CVE-2010-0304—99.5%
——30——CVE-2018-17243—99.5%
——30——CVE-2021-27275—99.5%
——30——