Vulnerabilities exploitable today
401,106in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,665
Distribution · last window
- Critical3,451
- High15,759
- Medium14,743
- Low1,453
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2007-0584—99.4%
——30——CVE-2016-7288—99.4%
——30——CVE-2024-25723—99.4%
——30——CVE-2023-22621—99.4%
——30——CVE-2019-0547—99.4%
——30——CVE-2022-23270—99.4%
——30——CVE-2019-12780—99.4%
——30——CVE-2007-0169—99.4%
——30——CVE-2022-28381—99.4%
——30——CVE-2024-22729—99.4%
——30——CVE-2001-0540—99.4%
——30——CVE-2011-3400—99.4%
——30——CVE-2009-4195—99.4%
——30——CVE-2016-3247—99.4%
——30——CVE-2006-2407—99.4%
——30——CVE-2020-10821—99.4%
——30——CVE-2015-2845—99.4%
——30——CVE-2020-15175—99.4%
——30——CVE-2021-46419—99.4%
——30——CVE-2021-4039—99.4%
——30——CVE-2013-4811—99.4%
——30——CVE-2015-0096—99.4%
——30——CVE-2008-0166—99.4%
——30——CVE-2006-6565—99.4%
——30——CVE-2018-20434—99.4%
——30——CVE-2015-2509—99.4%
——30——CVE-2017-8895—99.4%
——30——CVE-2024-5762—99.4%
——30——CVE-2013-2751—99.4%
——30——CVE-2022-26133—99.4%
——30——CVE-2023-02867.4 HIG99.4%
——30There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
the public structure definition for GENERAL_NAME incorrectly specified the type
of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by
the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an
ASN1_STRING.
When CRL checking is enabled (i.e. the application sets the
X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass
arbitrary pointers to a memcmp call, enabling them to read memory contents or
enact a denial of service. In most cases, the attack requires the attacker to
provide both the certificate chain and CRL, neither of which need to have a
valid signature. If the attacker only controls one of these inputs, the other
input must already contain an X.400 address as a CRL distribution point, which
is uncommon. As such, this vulnerability is most likely to only affect
applications which have implemented their own functionality for retrieving CRLs
over a network.7dCVE-2023-38171—99.4%
——30——CVE-2005-2799—99.4%
——30——CVE-2011-3492—99.4%
——30——CVE-2023-20864—99.4%
——30——CVE-2003-0213—99.4%
——30——CVE-2014-1762—99.4%
——30——CVE-2016-2510—99.4%
——30——CVE-2024-4439—99.4%
——30——CVE-2020-13580—99.4%
——30——