0.7%
actively
exploited
exploited
Focus on what’s exploited
Out of 351,186 known CVEs, only 0.7% show real-world exploitation signals.
Data from public sources (including CISA) plus private sensors, enriched with prioritization metadata.
2,513
Total Known exploited
452
Added this week
902
More than CISA KEV
Search
Results update as you type.
⌘K
Added
Exploitability
Type to search. Filters apply instantly.
| CVE | Severity | Title |
|---|---|---|
| CVE-2026-7473 | 6.9 Medium |
Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass
Remote
Low complexity
No user interaction
|
| CVE-2026-3300 | 9.8 Critical |
Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field
Remote
Low complexity
No user interaction
|
| CVE-2026-20245 | 7.8 High |
Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability
Low complexity
No user interaction
|
| CVE-2026-45247 | 9.3 Critical |
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
Remote
Low complexity
No user interaction
|
| CVE-2025-48827 | 10.0 Critical |
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP...
Remote
Low complexity
No user interaction
|
| CVE-2026-8206 | 9.8 Critical |
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
Remote
Low complexity
No user interaction
|
| CVE-2025-9316 | 6.9 Medium |
N-central unauthenticated sessionID generation
Remote
Low complexity
No user interaction
|
| CVE-2026-41176 | 9.2 Critical |
Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
Remote
Low complexity
No user interaction
|
| CVE-2022-4059 | 9.8 Critical |
Cryptocurrency Widgets Pack < 2.0 - Unauthenticated SQLi
Remote
Low complexity
No user interaction
|
| CVE-2023-6909 | 7.5 High |
Path Traversal: '\..\filename' in mlflow/mlflow
Remote
Low complexity
No user interaction
|
| CVE-2022-0492 | 7.8 High |
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain...
Low complexity
No user interaction
|
| CVE-2025-48595 | 8.4 High |
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of...
Low complexity
No user interaction
|
| CVE-2026-41089 | 9.8 Critical |
Windows Netlogon Remote Code Execution Vulnerability
Remote
Low complexity
No user interaction
|
| CVE-2024-21182 | 7.5 High |
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are...
Remote
Low complexity
No user interaction
|
| CVE-2023-43000 | 8.8 High |
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari...
Remote
Low complexity
|
| CVE-2025-31277 | 8.8 High |
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6,...
Remote
Low complexity
|
| CVE-2026-9082 | 9.8 Critical |
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
Remote
Low complexity
No user interaction
|
| CVE-2026-48172 | 10.0 Critical |
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is...
Remote
Low complexity
No user interaction
|
| CVE-2026-34926 | 6.7 Medium |
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the...
No user interaction
|
| CVE-2025-34291 | 9.4 Critical |
Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE
Remote
Low complexity
|
| CVE-2026-45498 | 4.0 Medium |
Microsoft Defender Denial of Service Vulnerability
Low complexity
No user interaction
|
| CVE-2026-41091 | 7.8 High |
Microsoft Defender Elevation of Privilege Vulnerability
Low complexity
No user interaction
|
| CVE-2026-34234 | 10.0 Critical |
CtrlPanel: Unauthenticated RCE using installer script
Remote
Low complexity
No user interaction
|
| CVE-2026-42897 | 8.1 High |
Microsoft Exchange Server Spoofing Vulnerability
Remote
Low complexity
|
| CVE-2026-42208 | 9.3 Critical |
LiteLLM: SQL injection in Proxy API key verification
Remote
Low complexity
No user interaction
|
Displaying vulnerabilities 1 - 25 of 2513 in total