Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2015-5477KEVexploit ×10 | 7.5 high | 100.0% | juniper, fedoraproject, junos, fedora, enterprise_linux | named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries. | 9 Oct |
| CVE-2021-3449exploit | 5.9 medium | 64.0% | openssl, debian, debian_linux, freebsd | An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j). | 8 Oct |
| CVE-2022-25236exploit | 9.8 critical | 35.0% | libexpat_project, debian, libexpat, debian_linux, http_server | xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. | 14 Oct |
| CVE-2025-13390exploit ×2 | 9.8 critical | 5.0% | wpdirectorykit, wp_directory_kit | The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the feature using a cryptographically weak token generation mechanism. This makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token. | 18 Oct |
| CVE-2022-25315exploit | 9.8 critical | 5.0% | libexpat_project, debian, libexpat, debian_linux, fedora | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. | 14 Oct |
| CVE-2022-25235exploit | 9.8 critical | 5.0% | libexpat_project, debian, libexpat, debian_linux, fedora | xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. | 14 Oct |
| CVE-2022-25314exploit | 7.5 high | 5.0% | libexpat_project, debian, libexpat, debian_linux, fedora | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. | 14 Oct |
| CVE-2021-41617exploit | 7.0 high | 3.0% | openbsd, fedoraproject, openssh, fedora, active_iq_unified_manager | sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. | 14 Oct |
| CVE-2022-25313exploit ×2 | 6.5 medium | 3.0% | libexpat_project, debian, libexpat, debian_linux, fedora | In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. | 14 Oct |
| CVE-2026-28001exploit | 9.3 critical | 0.00% | no CPE yet | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | Fri 23 Oct |
10 of 10
Download these 10 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.