CVE Watch402,574 en archivo total

Vulnerabilidades explotables hoy

15,732en la vista actual

Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.

En catálogo KEV1,756

Nuevos KEV · 24H0

Exploit Today ≥ 701,689

Distribución · última ventana

Crítico
4,425
Alto
17,990
Medio
16,577
Bajo
1,662

Filtros

Ventana

Severidad

Filtros

Vulnerabilidades13,961–14,000 · 15,732

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-475007.8 ALT

3.5%

——1NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where improper cleanup of reference counts during error paths could lead to a use-after-free condition. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.25d CVE-2026-474997.8 ALT

2.3%

——1NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer where a guest could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.25d CVE-2026-474987.8 ALT

2.3%

——1NVIDIA vGPU Manager contains a vulnerability in the GPU System Processor (GSP) plugin where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC message. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.25d CVE-2026-474977.8 ALT

0.9%

——0NVIDIA Virtual GPU Manager contains a vulnerability in the GPU System Processor (GSP) tracing component where a guest VM user may cause improper access by sending crafted data through a shared buffer. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.25d CVE-2026-474967.3 ALT

1.7%

——1NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC call to the host. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, and denial of service.25d CVE-2026-474957.8 ALT

2.3%

——1NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.25d CVE-2026-474947.8 ALT

3.8%

——1NVIDIA GPU Display Driver for Linux contains a vulnerability where a user might be able to cause a format string issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.25d CVE-2026-474937.8 ALT

1.4%

——0NVIDIA vGPU software for Windows and Linux contains a vulnerability in the GPU kernel driver where a guest may access privileged host GPU resources for which it is not authorized. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.25d CVE-2026-474917.8 ALT

3.8%

——1NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can cause improper release of memory resources, leaving a mapping accessible after the underlying memory is reused. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.25d CVE-2026-1034363.7 BAJ

21.6%

——6apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi. On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf("%*s %*s %s", answer) performs no assignment but the function returns success, and thus the caller prints the uninitialized destination buffer into the HTTP response.23d CVE-2026-1032317.3 ALT

18.0%

——5A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqli_query of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.23d CVE-2026-10242710.0 CRÍ

60.4%

——18Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing.24d CVE-2026-1002803.1 BAJ

6.5%

——2In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible23d CVE-2026-1002796.5 MED

15.9%

——5In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials23d CVE-2026-1002784.9 MED

14.3%

——4In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments23d CVE-2026-1002778.9 ALT

21.2%

——6In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature23d CVE-2026-1002765.9 MED

11.9%

——4In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action23d CVE-2026-1002756.9 MED

8.6%

——3In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible23d CVE-2026-1002746.5 MED

57.7%

——17In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template23d CVE-2026-1002738.2 ALT

22.7%

——7In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution23d CVE-2026-1002724.9 MED

21.0%

——6In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues23d CVE-2026-1002712.7 BAJ

13.4%

——4In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects23d CVE-2026-1002703.3 BAJ

7.2%

——2In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations23d CVE-2026-1002694.3 MED

10.1%

——3In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed24d CVE-2026-1002687.7 ALT

13.6%

——4In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates24d CVE-2026-1002675.9 MED

20.9%

——6In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters24d CVE-2026-1002667.7 ALT

13.4%

——4In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address23d CVE-2026-1002654.8 MED

1.0%

——0In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation23d CVE-2026-1002642.7 BAJ

13.4%

——4In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host23d CVE-2026-1002634.7 MED

8.8%

——3In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible23d CVE-2026-1002627.6 ALT

11.3%

——3In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates23d CVE-2026-1002615.4 MED

7.0%

——2In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission23d CVE-2026-1002605.3 MED

18.3%

——5In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset23d CVE-2026-1002594.3 MED

8.9%

——3In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access23d CVE-2026-1002584.3 MED

51.0%

——15In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings23d CVE-2026-1002574.3 MED

10.4%

——3In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export23d CVE-2026-1002567.8 ALT

2.8%

——1In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects23d CVE-2026-1002558.1 ALT

28.4%

——9In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset23d CVE-2026-1002548.8 ALT

40.5%

——12In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings19d CVE-2026-1002538.8 ALT

38.4%

——12In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL19d