Vulnerabilidades explotables hoy
405,425en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,762
Nuevos KEV · 24H0
Exploit Today ≥ 701,694
Distribución · última ventana
- Crítico5,620
- Alto21,747
- Medio20,103
- Bajo2,112
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2023-46216—98.5%
——30——CVE-2018-6580—98.5%
——30——CVE-2014-6036—98.5%
——30——CVE-2015-2456—98.5%
——30——CVE-2018-16288—98.5%
——30——CVE-2022-23450—98.5%
——30——CVE-2008-1457—98.5%
——30——CVE-2024-23988.6 ALT98.5%
——30When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.15dCVE-2025-32814—98.5%
——30——CVE-2023-41727—98.5%
——30——CVE-2015-3783—98.5%
——30——CVE-2000-09135.0 SIN98.5%
——30mod_rewrite in Apache 1.3.12 and earlier allows remote attackers to read arbitrary files if a RewriteRule directive is expanded to include a filename whose name contains a regular expression.37dCVE-2005-0772—98.5%
——30——CVE-2008-3477—98.5%
——30——CVE-2008-3021—98.5%
——30——CVE-2006-5581—98.5%
——30——CVE-2003-0111—98.5%
——30——CVE-2008-5518—98.5%
——30——CVE-2006-1516—98.5%
——30——CVE-2026-464429.9 CRÍ98.5%
——30Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When E2B_APIKEY is not configured — the common deployment case — Flowise executes this code inside a NodeVM sandbox. This sandbox can be escaped, allowing an attacker to reach the host process object and execute system commands via child_process. The result is authenticated remote code execution on the Flowise server host. This issue has been patched in version 3.1.2.99dCVE-2009-0227—98.5%
——30——CVE-2013-3868—98.5%
——30——CVE-2019-15642—98.5%
——30——CVE-2012-0393—98.5%
——30——CVE-2025-5306—98.5%
——30——CVE-2019-8917—98.5%
——30——CVE-2007-3895—98.5%
——30——CVE-2024-43464—98.5%
——30——CVE-2007-0064—98.5%
——30——CVE-2022-322066.5 MED98.5%
——30curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.15dCVE-2003-1336—98.5%
——30——CVE-2015-2464—98.5%
——30——CVE-2010-1527—98.5%
——30——CVE-2015-2510—98.5%
——30——CVE-2019-6339—98.5%
——30——CVE-2015-6835—98.5%
——30——CVE-2014-0784—98.5%
——30——CVE-2008-3006—98.5%
——30——CVE-2017-0266—98.5%
——30——CVE-1999-1412—98.5%
——30——