zerodayfindings.com

The public CVE record, lined up.

Metadata from CVE.org, NVD, CISA KEV, OSV, and the other public catalogs. Sort it by source, severity, weakness, and stack. Exploit code stays where it was published.

Priority queue Source status

Records: 2,299
Known exploited: 1,741
Critical: 674
Sources live: 11/21

Priority

Known exploited

Critical 9.8CVE-2025-53770KEVEPSS 100.0%
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
microsoft · sharepoint server · CISA KEV · CVE.org · FIRST EPSS · Exploit Database · microsoft · Jul 19, 2025
Critical 9.8CVE-2024-7593KEVEPSS 100.0%
Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
ivanti · virtual traffic manager · CISA KEV · CVE.org · FIRST EPSS · Metasploit Modules · ivanti · Aug 13, 2024
Critical 10.0CVE-2024-3400KEVEPSS 100.0%
Palo Alto Networks PAN-OS Command Injection Vulnerability
paloaltonetworks · pan-os · CISA KEV · CVE.org · FIRST EPSS · Exploit Database · paloalto · Apr 12, 2024
High 8.2CVE-2024-21893KEVEPSS 100.0%
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
ivanti · connect secure · CISA KEV · CVE.org · FIRST EPSS · Metasploit Modules · ivanti · Jan 31, 2024
Critical 9.8CVE-2024-23897KEVEPSS 100.0%
Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
jenkins · jenkins · CISA KEV · CVE.org · FIRST EPSS · Exploit Database · Jan 24, 2024
Critical 9.1CVE-2024-21887KEVEPSS 100.0%
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
ivanti · connect secure · CISA KEV · CVE.org · FIRST EPSS · Metasploit Modules · ivanti · Jan 10, 2024

Fresh

All findings

The public CVE record, lined up.

Priority

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability

Palo Alto Networks PAN-OS Command Injection Vulnerability

Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

Fresh

Malicious code in @kre64/hello-npm-test (npm)

Malicious code in crelic-bqwheel-52f66a3f1d (PyPI)

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and includin…

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to,…

Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL).

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and Oct…

21 catalogs, one record