Vulnerabilidades explotables hoy
402,779en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,756
Nuevos KEV · 24H0
Exploit Today ≥ 701,689
Distribución · última ventana
- Crítico5,086
- Alto19,906
- Medio18,230
- Bajo1,858
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2023-33106—55.9%
KEV—67Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability—CVE-2024-4610—55.1%
KEV—67Arm Mali GPU Kernel Driver Use-After-Free Vulnerability—CVE-2023-33107—54.3%
KEV—66Qualcomm Multiple Chipsets Integer Overflow Vulnerability—CVE-2024-43093—53.2%
KEV—66Android Framework Privilege Escalation Vulnerability—CVE-2026-533627.8 ALT53.2%
KEV—66Linux Kernel Unspecified Vulnerability11dCVE-2019-8526—53.0%
KEV—66Apple macOS Use-After-Free Vulnerability—CVE-2025-1976—52.5%
KEV—66Broadcom Brocade Fabric OS Code Injection Vulnerability—CVE-2021-39793—52.3%
KEV—66Google Pixel Out-of-Bounds Write Vulnerability—CVE-2024-29748—51.9%
KEV—66Android Pixel Privilege Escalation Vulnerability—CVE-2023-33063—51.8%
KEV—66Qualcomm Multiple Chipsets Use-After-Free Vulnerability—CVE-2024-43047—51.6%
KEV—65Qualcomm Multiple Chipsets Use-After-Free Vulnerability—CVE-2026-663845.3 MED51.5%
KEV—65JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability2dCVE-2021-25487—50.1%
KEV—65Samsung Mobile Devices Out-of-Bounds Read Vulnerability—CVE-2025-48543—50.1%
KEV—65Android Runtime Use-After-Free Vulnerability—CVE-2026-587048.8 ALT49.7%
KEV—65Google Pixel Improper Authorization Vulnerability19dCVE-2025-48928—47.3%
KEV—64TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability—CVE-2021-25489—44.6%
KEV—63Samsung Mobile Devices Improper Input Validation Vulnerability—CVE-2021-1906—43.9%
KEV—63Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability—CVE-2022-48618—41.6%
KEV—62Apple Multiple Products Memory Corruption Vulnerability—CVE-2024-29745—41.6%
KEV—62Android Pixel Information Disclosure Vulnerability—CVE-2025-21480—39.7%
KEV—62Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability—CVE-2025-47729—38.6%
KEV—62TeleMessage TM SGNL Hidden Functionality Vulnerability—CVE-2025-435205.5 MED36.5%
KEV—61Apple Multiple Products Classic Buffer Overflow Vulnerability19dCVE-2022-22071—35.0%
KEV—61Qualcomm Multiple Chipsets Use-After-Free Vulnerability—CVE-2021-25394—34.1%
KEV—60Samsung Mobile Devices Race Condition Vulnerability—CVE-2026-819637.8 ALT33.3%
KEV—60Microsoft Windows Link Following Vulnerability47dCVE-2022-22265—32.7%
KEV—60Samsung Mobile Devices Use-After-Free Vulnerability—CVE-2026-858807.8 ALT32.5%
KEV—60Microsoft Windows Heap-Based Buffer Overflow Vulnerability32dCVE-2021-25395—30.2%
KEV—59Samsung Mobile Devices Race Condition Vulnerability—CVE-2025-435107.8 ALT29.0%
KEV—59Apple Multiple Products Improper Locking Vulnerability19dCVE-2026-561557.8 ALT27.9%
KEV—58Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability 103dCVE-2026-688207.0 ALT26.2%
KEV—58Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability71dCVE-2023-21237—18.3%
KEV—55Android Pixel Information Disclosure Vulnerability —CVE-2025-486335.5 MED17.8%
KEV—55Android Framework Information Disclosure Vulnerability19dCVE-2025-485727.8 ALT17.4%
KEV—55Android Framework Privilege Escalation Vulnerability19dCVE-2026-878867.8 ALT14.1%
KEV—54Acronis Backup Incorrect Default Permissions Vulnerability38dCVE-2023-50387—100.0%
——30——CVE-2021-451055.9 MED100.0%
——30Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.62dCVE-2026-1096198.1 ALT100.0%
——30PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).3hCVE-2014-3566—100.0%
——30——