Vulnerabilidades explotables hoy
406,286en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,766
Nuevos KEV · 24H0
Exploit Today ≥ 701,698
Distribución · última ventana
- Crítico5,573
- Alto21,612
- Medio20,107
- Bajo2,091
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2021-43527—97.1%
——29——CVE-2024-34218—97.1%
——29——CVE-2016-4177—97.1%
——29——CVE-2025-4111510.0 CRÍ97.1%
——29SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.
In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation.
This vulnerability applies only if all of the following conditions are met:
- `enableSCIM` feature flag set to true
- `user_sync_enabled` config option in the `[auth.scim]` block set to true14dCVE-2016-3373—97.1%
——29——CVE-2026-909709.9 CRÍ97.1%
——29GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.30dCVE-2017-12945—97.1%
——29——CVE-2014-0293—97.1%
——29——CVE-2024-47855—97.1%
——29——CVE-2022-4395—97.1%
——29——CVE-2015-0092—97.1%
——29——CVE-2025-0283—97.1%
——29——CVE-2001-0150—97.1%
——29——CVE-2019-0217—97.1%
——29——CVE-2023-36397—97.1%
——29——CVE-2024-13171—97.1%
——29——CVE-2012-0271—97.1%
——29——CVE-2025-712584.3 MED97.1%
——29BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests. Attackers can exploit improper URL validation to perform internal network scanning or interact with internal services, impacting system availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.87dCVE-1999-0469—97.1%
——29——CVE-2006-5020—97.1%
——29——CVE-2018-16660—97.1%
——29——CVE-2014-0269—97.1%
——29——CVE-2002-0726—97.1%
——29——CVE-2014-0749—97.1%
——29——CVE-2008-4493—97.1%
——29——CVE-2012-4412—97.1%
——29——CVE-2020-24916—97.1%
——29——CVE-2022-1529—97.1%
——29——CVE-2017-10075—97.1%
——29——CVE-2025-113314.7 MED97.1%
——29A vulnerability was found in IdeaCMS up to 1.8. The impacted element is an unknown function of the file app/common/logic/admin/Config.php of the component Website Name Handler. Performing manipulation of the argument 网站名称 results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.13dCVE-2015-1756—97.1%
——29——CVE-2008-5191—97.1%
——29——CVE-2021-33357—97.1%
——29——CVE-2019-6446—97.1%
——29——CVE-2020-0767—97.1%
——29——CVE-2012-0881—97.1%
——29——CVE-2002-1688—97.1%
——29——CVE-2012-4787—97.1%
——29——CVE-2024-582748.3 ALT97.1%
——29Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025.31dCVE-2011-1993—97.1%
——29——