Vulnerabilidades explotables hoy
406,199en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,766
Nuevos KEV · 24H0
Exploit Today ≥ 701,698
Distribución · última ventana
- Crítico5,599
- Alto21,774
- Medio20,288
- Bajo2,104
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2003-0282—97.7%
——29——CVE-2017-1000385—97.7%
——29——CVE-2004-0124—97.7%
——29——CVE-2025-581808.8 ALT97.7%
——29OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler and said event gets triggered. If no event handlers executing system commands with uploaded filenames as parameters have been configured, this vulnerability does not have an impact. The vulnerability is patched in version 1.11.3. As a workaround, OctoPrint administrators who have event handlers configured that include any kind of filename based placeholders should disable those by setting their `enabled` property to `False` or unchecking the "Enabled" checkbox in the GUI based Event Manager. Alternatively, OctoPrint administrators should set `feature.enforceReallyUniversalFilenames` to `true` in `config.yaml` and restart OctoPrint, then vet the existing uploads and make sure to delete any suspicious looking files. As always, OctoPrint administrators are advised to not expose OctoPrint on hostile networks like the public internet, and to vet who has access to their instance.12dCVE-2006-2444—97.7%
——29——CVE-2021-39341—97.7%
——29——CVE-2018-19365—97.7%
——29——CVE-2022-31711—97.7%
——29——CVE-2023-2479—97.7%
——29——CVE-2017-0120—97.7%
——29——CVE-2008-2469—97.7%
——29——CVE-2014-4671—97.7%
——29——CVE-2020-137777.4 ALT97.7%
——29GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.17dCVE-2005-4089—97.7%
——29——CVE-2012-2550—97.7%
——29——CVE-2022-37027—97.7%
——29——CVE-2017-56749.8 CRÍ97.6%
——29A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.ini HTTP/1.1\n\n" - note the lack of "/" in the path field of the request) request that will disclose the configuration file with the login password.16dCVE-2013-3127—97.6%
——29——CVE-2006-0544—97.6%
——29——CVE-2016-7248—97.6%
——29——CVE-2013-0189—97.6%
——29——CVE-2016-0480—97.6%
——29——CVE-2021-270789.1 CRÍ97.6%
——29Microsoft Exchange Server Remote Code Execution Vulnerability73dCVE-2018-8057—97.6%
——29——CVE-2013-3863—97.6%
——29——CVE-2013-0249—97.6%
——29——CVE-1999-0886—97.6%
——29——CVE-2017-14135—97.6%
——29——CVE-2022-30450—97.6%
——29——CVE-2006-3511—97.6%
——29——CVE-2014-3300—97.6%
——29——CVE-2016-0478—97.6%
——29——CVE-2018-20525—97.6%
——29——CVE-2009-4502—97.6%
——29——CVE-1999-1105—97.6%
——29——CVE-2022-1390—97.6%
——29——CVE-2007-3927—97.6%
——29——CVE-2011-1250—97.6%
——29——CVE-2007-3037—97.6%
——29——CVE-2011-0222—97.6%
——29——