6 CVEs matched to Core Security by name in NVD, none on CISA's Known Exploited list.
Back to the Core Security profile · Alternatives to Core Security · CVE RSS feed
2 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.
Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.
A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and ac…
Windows Remote Desktop Protocol Core Security Feature Bypass Vulnerability
ASP.NET Core Security Feature Bypass Vulnerability
| Year | Critical | High | Medium | Low | Unscored | Total |
|---|---|---|---|---|---|---|
| 2025 | 1 | 0 | 2 | 0 | 1 | 4 |
| 2023 | 0 | 0 | 1 | 0 | 0 | 1 |
| 2021 | 0 | 1 | 0 | 0 | 0 | 1 |
EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.
| CVE | EPSS | Percentile |
|---|---|---|
| CVE-2025-5120 | 26% | 98% |
| CVE-2021-1674 | 3.2% | 88% |
| CVE-2023-36558 | 1.1% | 65% |
| CVE-2025-58246 | 0.3% | 18% |
| CVE-2025-58674 | 0.2% | 11% |
| CVE-2025-29779 | 0.2% | 7.5% |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress allows Stored XSS. WordPress core security team is aware of the issue and working on a f…
Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a…
Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0b…
Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware …
A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code execution (RCE). The v…
Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0b2 and prior, the `secure_redundant_execu…
ASP.NET Core Security Feature Bypass Vulnerability
Windows Remote Desktop Protocol Core Security Feature Bypass Vulnerability