Vulnerabilidades explotables hoy
405,425en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,762
Nuevos KEV · 24H0
Exploit Today ≥ 701,694
Distribución · última ventana
- Crítico5,620
- Alto21,747
- Medio20,103
- Bajo2,112
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2024-43363—98.5%
——30——CVE-2008-3021—98.5%
——30——CVE-2022-229506.5 MED98.5%
——30n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.21dCVE-2018-7582—98.5%
——30——CVE-2021-22146—98.5%
——30——CVE-2008-1457—98.5%
——30——CVE-2002-1182—98.5%
——30——CVE-2022-4230—98.5%
——30——CVE-2025-5306—98.5%
——30——CVE-2006-1516—98.5%
——30——CVE-1999-1575—98.5%
——30——CVE-2012-0284—98.5%
——30——CVE-2023-1454—98.5%
——30——CVE-2021-43936—98.5%
——30——CVE-2005-0582—98.5%
——30——CVE-2008-5626—98.5%
——30——CVE-2008-3477—98.5%
——30——CVE-2024-38071—98.5%
——30——CVE-2008-5790—98.5%
——30——CVE-2014-8998—98.5%
——30——CVE-2009-1533—98.5%
——30——CVE-2024-43464—98.5%
——30——CVE-2022-322066.5 MED98.5%
——30curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.15dCVE-2015-2456—98.5%
——30——CVE-2016-3321—98.5%
——30——CVE-2022-26965—98.5%
——30——CVE-2022-23450—98.5%
——30——CVE-2006-5581—98.5%
——30——CVE-2021-43405—98.5%
——30——CVE-2014-0784—98.5%
——30——CVE-2018-6580—98.5%
——30——CVE-2023-4197—98.5%
——30——CVE-2008-3006—98.5%
——30——CVE-2007-3902—98.4%
——30——CVE-2026-445788.6 ALT98.4%
——30Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.4dCVE-2026-33032—98.4%
——30——CVE-2004-0568—98.4%
——30——CVE-2008-1724—98.4%
——30——CVE-2023-337828.8 ALT98.4%
——30D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnostics function.113dCVE-2026-1357—98.4%
——30——