Vulnerabilidades explotables hoy
405,617en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,764
Nuevos KEV · 24H0
Exploit Today ≥ 701,697
Distribución · última ventana
- Crítico5,594
- Alto21,701
- Medio20,085
- Bajo2,112
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2020-14825—98.2%
——29——CVE-2008-0470—98.2%
——29——CVE-2018-18472—98.2%
——29——CVE-2020-35749—98.2%
——29——CVE-2008-3018—98.2%
——29——CVE-2018-7300—98.2%
——29——CVE-2024-4322—98.2%
——29——CVE-2024-22836—98.2%
——29——CVE-2003-0665—98.2%
——29——CVE-2015-5343—98.2%
——29——CVE-2015-4870—98.2%
——29——CVE-2017-2933—98.2%
——29——CVE-2011-0656—98.2%
——29——CVE-2023-524429.1 CRÍ98.2%
——29In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate session id and tree id in compound request
`smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session()
will always return the first request smb2 header in a compound request.
if `SMB2_TREE_CONNECT_HE` is the first command in compound request, will
return 0, i.e. The tree id check is skipped.
This patch use ksmbd_req_buf_next() to get current command in compound.87dCVE-2023-4474—98.2%
——29——CVE-2005-4797—98.2%
——29——CVE-2019-0853—98.2%
——29——CVE-2021-46367—98.2%
——29——CVE-2024-53991—98.2%
——29——CVE-2015-1158—98.2%
——29——CVE-2015-6125—98.2%
——29——CVE-2024-20356—98.2%
——29——CVE-2011-4135—98.2%
——29——CVE-2018-16059—98.2%
——29——CVE-2024-43452—98.2%
——29——CVE-2021-26701—98.2%
——29——CVE-2025-633877.5 ALT98.2%
——29Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails to implement proper authorization checks, allowing anonymous access to sensitive system configuration data. NOTE: The maintainer states that the endpoint is unauthenticated by design and serves as a bootstrap mechanism required for the dashboard initialization. They also state that the description inaccurately classifies the returned data as sensitive system configuration, stating that the data is non-sensitive and required for client-side rendering. No PII, credentials, or secrets are exposed.17dCVE-2002-0082—98.2%
——29——CVE-2008-0551—98.2%
——29——CVE-2001-0242—98.2%
——29——CVE-2014-3515—98.2%
——29——CVE-2023-31478—98.2%
——29——CVE-2007-6255—98.2%
——29——CVE-2008-0083—98.2%
——29——CVE-2015-0040—98.2%
——29——CVE-2023-20032—98.2%
——29——CVE-2016-5645—98.2%
——29——CVE-2009-0850—98.2%
——29——CVE-2018-7846—98.2%
——29——CVE-2012-0177—98.2%
——29——