Vulnerabilities exploitable today
408,445in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,768
New KEV · 24H0
Exploit Today ≥ 701,698
Distribution · last window
- Critical5,774
- High22,377
- Medium20,989
- Low2,174
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-107967.5 HIG92.3%
——28nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as `nvm install` read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs and shell/awk commands. Two sinks are affected by the same untrusted input: nvm_download() built a curl/wget command string and ran it with `eval`, so a version field containing command substitution (for example $(id)) was executed by the local shell; and nvm_get_checksum() interpolated the version-derived download slug into an awk program, so a crafted version could execute arbitrary commands via awk's system(). An attacker who controls the configured mirror, supplies mirror content to a user or CI on a non-default mirror, or machine-in-the-middles a non-TLS mirror can ∴ run arbitrary commands with the privileges of the user running nvm. The default mirror (https://nodejs.org over TLS) is not affected. Fixed on master (pending the next tagged release) by passing every argument as a literal argv element instead of using eval, by passing the value to awk as data via -v instead of interpolating it into the program, and by rejecting any version outside the Node.js/io.js version grammar before it is used.106dCVE-2017-8637—92.3%
——28——CVE-2025-59474—92.3%
——28——CVE-2022-21974—92.3%
——28——CVE-2015-1781—92.3%
——28——CVE-2019-0723—92.3%
——28——CVE-2000-1139—92.3%
——28——CVE-2014-9097—92.3%
——28——CVE-2024-29275—92.3%
——28——CVE-2017-14385—92.3%
——28——CVE-2015-0860—92.3%
——28——CVE-2015-8154—92.3%
——28——CVE-2000-0523—92.3%
——28——CVE-2011-3342—92.3%
——28——CVE-2019-6557—92.3%
——28——CVE-2007-1195—92.3%
——28——CVE-2024-7340—92.3%
——28——CVE-2008-0002—92.3%
——28——CVE-2016-9268—92.3%
——28——CVE-2017-2928—92.3%
——28——CVE-1999-1222—92.3%
——28——CVE-2021-39174—92.3%
——28——CVE-2024-29195—92.3%
——28——CVE-2012-4337—92.3%
——28——CVE-2017-3069—92.3%
——28——CVE-2014-9173—92.3%
——28——CVE-2012-3010—92.3%
——28——CVE-2016-4398—92.3%
——28——CVE-2019-20141—92.3%
——28——CVE-2026-505076.8 MED92.3%
——28Missing authentication for critical function in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.105dCVE-2010-4190—92.3%
——28——CVE-2008-0924—92.3%
——28——CVE-2009-3863—92.3%
——28——CVE-2016-1767—92.3%
——28——CVE-2004-0398—92.3%
——28——CVE-2012-3995—92.3%
——28——CVE-2012-1799—92.3%
——28——CVE-2014-6120—92.3%
——28——CVE-2018-8481—92.3%
——28——CVE-2008-4059—92.3%
——28——