CVE Watch414,707 en archivo total

Vulnerabilidades explotables hoy

414,707en la vista actual

Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.

En catálogo KEV1,779

Nuevos KEV · 24H0

Exploit Today ≥ 701,707

Distribución · última ventana

Crítico
5,438
Alto
21,753
Medio
20,070
Bajo
2,096

Filtros

Ventana

Severidad

Filtros

Vulnerabilidades414,321–414,360 · 414,707

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2017-4874—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none28d CVE-2025-34787—

—

——0Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.25d CVE-2018-4740—

—

——0Rejected reason: This candidate is unused by its CNA.27d CVE-2026-1064056.0 MED

0.0%

——0Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Medium)35d CVE-2025-34533—

—

——0Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.27d CVE-2014-3644—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none27d CVE-2026-240907.1 ALT

0.0%

——0Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow.114d CVE-2025-36545—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused25d CVE-2017-15543—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none27d CVE-2017-4076—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none27d CVE-2026-256006.4 MED

0.0%

——0The PDBM application relies on a static, hard‑coded secret embedded in the PDBM.exe executable. This secret is used by the application’s encryption routines, including the function responsible for decrypting credentials stored in the product’s configuration file. Because the secret is constant across installations, any attacker with sufficient local privileges can extract it from the binary. Once obtained, the secret allows the attacker to decrypt the stored password and authenticate as the user defined in the configuration file. In the affected version, this user account is configured with administrative privileges, granting full access to PDBM’s management interface and its underlying operational functions.115d CVE-2022-47401—

—

——0Rejected reason: Not used27d CVE-2025-68789—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.28d CVE-2018-9197—

—

——0Rejected reason: Not used27d CVE-2025-37942—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.28d CVE-2016-3380—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none27d CVE-2018-11661—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none27d CVE-2026-65214—

—

——0Rejected reason: The reported issue is tracked under CVE-2026-18449. This CVE ID is rejected as a duplicate.18d CVE-2026-253027.1 ALT

0.0%

——0Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.35d CVE-2017-4670—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none27d CVE-2017-4552—

—

0.0%

——0In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.59d CVE-2026-117757—

—

——0Rejected reason: Reserved in error; never associated with a vulnerability.17d CVE-2017-4457—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none27d CVE-2025-64476—

—

——0Rejected reason: Not used27d CVE-2026-252636.6 MED

0.0%

——0Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.35d CVE-2026-1163298.8 ALT

—

——0Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the database, via nested SET DATA TYPE during conversion of values to import. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.5h CVE-2026-1163288.8 ALT

—

——0Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.5h CVE-2026-1163308.8 ALT

—

——0Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is undocumented. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.5h CVE-2026-252677.8 ALT

0.0%

——0Memory corruption when non-secure loader rewrites page tables before secure memory initialization.35d CVE-2026-863568.8 ALT

—

———Dell PowerStore contains an authorization-bypass vulnerability that could lead to elevation of privilege to administrator.10h CVE-2026-1291537.1 ALT

—

———SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the referenced linkSurveyId belongs to the caller's own project. Authenticated attackers can point a linked option at another user's survey so that loadLinkResult and updateLinkSurveyAnswer read, rewrite, or create responses in that survey.8h CVE-2026-1291686.1 MED

—

———PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/{id}/{cid} endpoint returns email attachments verbatim with the sender-supplied Content-Type after cid: references are rewritten into attachment links. Unauthenticated SMTP senders can email a text/html attachment and a page-covering cid link, so a recipient who clicks the message runs script in their webmail session to change passwords, including the administrator's.8h CVE-2026-1291525.3 MED

—

———SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses because AnswerServiceImpl.saveAnswer skips login-required and survey password checks. Attackers can submit responses to protected surveys and set createBy in the request body to impersonate other users, corrupting survey results.4h CVE-2026-1291017.2 ALT

—

———Cudy TR3000 before 2.5.42 contains a mass assignment vulnerability in the vpn.set_conf App RPC method that allows authenticated administrators to inject arbitrary OpenVPN server options. Attackers can set enabled=1 and a malicious up option in the openvpns object, which the openvpn-hotplug wrapper executes via /bin/sh as root.10h CVE-2026-1291445.4 MED

—

———paicoding 1.0.3 contains a payment bypass vulnerability that allows authenticated attackers to unlock paid articles by guessing weak payment confirmation codes. Attackers can start a payment, enumerate roughly 2000 IdUtil.genPayCode counter values, and submit the matching verifyCode to the unauthenticated callback to mark it paid.8h CVE-2026-1291437.5 ALT

—

———paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint that allows unauthenticated attackers to read restricted articles. Attackers can enumerate article IDs via GET /article/api/data/detail/{articleId} to retrieve full content of paid, login-only, member-only and draft articles.8h CVE-2026-1291415.4 MED

—

———paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability because SeoInjectService embeds user profile text without escaping in an inline JSON-LD script element. Authenticated attackers can add a closing script tag followed by HTML to their profile, executing scripts for visitors of their profile page and stealing the non-HttpOnly f-session cookie.8h CVE-2026-1258336.5 MED

—

———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Ajax Product Filter yith-woocommerce-ajax-navigation allows Stored XSS.This issue affects YITH WooCommerce Ajax Product Filter: from n/a through 5.24.0.9h CVE-2026-97357—

—

———An Out-Of-Bounds Write due to missing input validation is possible in the autoprogramming interface of SpaceCom and Space Battery pack with WiFi which could lead to a denial of service of the affected communication device.6h