Vulnerabilidades explotables hoy
406,578en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,766
Nuevos KEV · 24H0
Exploit Today ≥ 701,698
Distribución · última ventana
- Crítico5,578
- Alto21,619
- Medio20,219
- Bajo2,099
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2019-1327—96.5%
——29——CVE-2019-11080—96.5%
——29——CVE-2008-3734—96.5%
——29——CVE-2008-2798—96.5%
——29——CVE-2015-1398—96.5%
——29——CVE-2002-0799—96.5%
——29——CVE-2023-30403—96.5%
——29——CVE-2016-3240—96.5%
——29——CVE-2024-8182—96.5%
——29——CVE-2017-0057—96.5%
——29——CVE-2013-3526—96.5%
——29——CVE-2010-3426—96.5%
——29——CVE-2019-18393—96.5%
——29——CVE-2009-1257—96.5%
——29——CVE-2016-3242—96.5%
——29——CVE-2015-6047—96.5%
——29——CVE-1999-1201—96.5%
——29——CVE-2002-1141—96.5%
——29——CVE-2011-1252—96.5%
——29——CVE-2016-0008—96.5%
——29——CVE-2018-8300—96.5%
——29——CVE-2024-30571—96.5%
——29——CVE-2002-1140—96.5%
——29——CVE-2019-1149—96.5%
——29——CVE-2000-1112—96.5%
——29——CVE-2009-3846—96.5%
——29——CVE-2017-9347—96.5%
——29——CVE-2010-2028—96.5%
——29——CVE-2015-6048—96.5%
——29——CVE-2026-438257.3 ALT96.5%
——29Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel
Versions Affected:
before 3.0.0-M4 (libsvm document categorization module; introduced in
OPENNLP-1808 and only present on the 3.x line)
Description:
SvmDoccatModel.deserialize(InputStream) reads an attacker-controlled
stream with java.io.ObjectInputStream and calls readObject() without an
ObjectInputFilter installed. ObjectInputStream materialises every class
referenced in the stream before the resulting object is cast to
SvmDoccatModel, so the cast that follows readObject() executes only
after the foreign object graph has already been deserialised in full.
If a Java deserialization gadget chain is available on the consumer's
classpath, a crafted payload supplied to
deserialize() executes arbitrary code in the JVM that loads it. Apache
OpenNLP itself does not ship a known gadget chain, so the realistic
risk is to downstream applications that embed the libsvm module
alongside vulnerable transitive dependencies. The method is public and
static, so any caller can pass an untrusted stream to it directly.
The practical impact is remote code execution against processes that
load SvmDoccatModel instances from untrusted or semi-trusted origins.
Mitigation:
3.x users should upgrade to 3.0.0-M4.
Users who cannot upgrade immediately should treat all serialized
SvmDoccatModel streams as untrusted input unless their provenance is
verified, and should avoid invoking SvmDoccatModel.deserialize() on
streams supplied by end users or fetched from third-party sources
without integrity checks.8dCVE-2002-0187—96.5%
——29——CVE-2012-1438—96.5%
——29——CVE-2022-27927—96.5%
——29——CVE-2006-1985—96.5%
——29——CVE-2015-7874—96.5%
——29——CVE-2012-4330—96.5%
——29——CVE-2023-40481—96.5%
——29——CVE-2004-1364—96.5%
——29——CVE-2001-1539—96.5%
——29——CVE-2021-22940—96.5%
——29——