Vulnerabilidades explotables hoy
15,523en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,756
Nuevos KEV · 24H0
Exploit Today ≥ 701,689
Distribución · última ventana
- Crítico4,727
- Alto18,786
- Medio17,140
- Bajo1,727
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-955267.3 ALT11.5%
——3Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.20dCVE-2026-95105—2.8%
——1Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping.
Cloak.Ciphers.AES.CTR encrypts with AES-256 in CTR mode and stores the key tag, the IV and the ciphertext with no MAC. decrypt/2 checks only the key tag and the minimum length before it returns the plaintext, and Cloak.Ciphers.Deprecated.AES.CTR decrypts the legacy format the same way. CTR is a stream cipher, so a value XORed into the stored ciphertext is XORed into the plaintext at the same offset. An attacker who can write to the encrypted store (for example through SQL injection or a compromised replica) and who knows or can guess a stored plaintext can replace it with any value of the same length. The application receives that value with no error.
This issue affects cloak: from 0.1.0-pre onward.20dCVE-2026-946757.1 ALT6.9%
——2Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.20dCVE-2026-94206—15.6%
——5Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured.
The dump/1 callback that Cloak.Ecto.PBKDF2 (Cloak.Fields.PBKDF2 in cloak before the Ecto code moved to cloak_ecto) injects into a field module calls :pbkdf2.pbkdf2/4 with config[:size] in the iteration-count position. The :iterations setting is validated but never used. With the cloak_ecto defaults (iterations: 600_000, size: 32) each hash runs 32 PBKDF2 rounds instead of 600,000, so offline guessing of values such as email addresses costs about 18,750 times less than configured.
This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0.20dCVE-2026-66588—20.9%
——6Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False-positive.13dCVE-2026-620728.8 ALT24.2%
——7Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.20dCVE-2026-4889—22.4%
——7SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an attacker to discover the platform's database engine and cause delays in database queries.20dCVE-2026-481997.5 ALT30.2%
——9Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.20dCVE-2026-481977.2 ALT37.0%
——11Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.20dCVE-2026-426387.5 ALT15.6%
——5Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.7.1 versions.20dCVE-2026-426376.5 MED24.5%
——7Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.20dCVE-2026-426367.1 ALT13.7%
——4Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.20dCVE-2026-426357.1 ALT13.7%
——4Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.20dCVE-2026-426347.1 ALT13.7%
——4Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.20dCVE-2026-424187.1 ALT13.7%
——4Unauthenticated Cross Site Scripting (XSS) in Social Rocket <= 1.3.5 versions.20dCVE-2026-424179.3 CRÍ23.9%
——7Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.20dCVE-2026-424168.5 ALT19.0%
——6Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.20dCVE-2026-424159.3 CRÍ15.3%
——5Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.20dCVE-2026-424148.5 ALT19.0%
——6Subscriber SQL Injection in ListingPro <= 2.9.12 versions.20dCVE-2026-424137.5 ALT22.8%
——7Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions.20dCVE-2026-415627.5 ALT22.8%
——7Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.20dCVE-2026-415617.5 ALT22.8%
——7Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.20dCVE-2026-415607.5 ALT21.0%
——6Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.20dCVE-2026-415597.5 ALT22.8%
——7Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 versions.20dCVE-2026-415559.3 CRÍ15.3%
——5Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.20dCVE-2026-408077.1 ALT6.9%
——2Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions.20dCVE-2026-408067.1 ALT6.9%
——2Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.20dCVE-2026-397986.5 MED15.2%
——5Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.20dCVE-2026-397979.8 CRÍ24.9%
——7Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.20dCVE-2026-397967.5 ALT21.0%
——6Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.20dCVE-2026-397959.3 CRÍ22.7%
——7Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions.20dCVE-2026-397947.5 ALT31.4%
——9Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.20dCVE-2026-397938.8 ALT33.3%
——10Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.20dCVE-2026-397928.6 ALT26.6%
——8Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.20dCVE-2026-397915.3 MED15.0%
——4Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions.20dCVE-2026-397907.1 ALT13.7%
——4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.7.18dCVE-2026-397886.5 MED10.4%
——3Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.20dCVE-2026-397876.5 MED20.0%
——6Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.20dCVE-2026-397859.3 CRÍ13.6%
——4Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1.13dCVE-2026-397847.1 ALT6.9%
——2Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.20d