Vulnerabilidades explotables hoy
409,563en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,769
Nuevos KEV · 24H0
Exploit Today ≥ 701,700
Distribución · última ventana
- Crítico5,569
- Alto21,245
- Medio20,367
- Bajo2,087
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2017-8770—95.7%
——29——CVE-2019-15993—95.7%
——29——CVE-2014-7891—95.7%
——29——CVE-2014-7897—95.7%
——29——CVE-2007-4042—95.7%
——29——CVE-2015-4602—95.7%
——29——CVE-2015-5149—95.7%
——29——CVE-2015-1762—95.7%
——29——CVE-2013-6884—95.7%
——29——CVE-2013-1368—95.7%
——29——CVE-2015-0501—95.7%
——29——CVE-2025-557549.6 CRÍ95.7%
——29Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.
Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.30dCVE-2009-1671—95.7%
——29——CVE-2006-1730—95.7%
——29——CVE-2000-0474—95.7%
——29——CVE-2009-2934—95.7%
——29——CVE-2005-1280—95.7%
——29——CVE-2018-15156—95.7%
——29——CVE-2024-4295—95.7%
——29——CVE-2018-15154—95.7%
——29——CVE-2009-0350—95.7%
——29——CVE-2019-7964—95.7%
——29——CVE-2018-15155—95.7%
——29——CVE-2016-2115—95.7%
——29——CVE-2019-8577—95.7%
——29——CVE-2012-0470—95.7%
——29——CVE-1999-0412—95.7%
——29——CVE-2015-7182—95.7%
——29——CVE-2018-121217.5 ALT95.7%
——29Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.30dCVE-2001-0405—95.7%
——29——CVE-2018-8324—95.7%
——29——CVE-2018-7183—95.7%
——29——CVE-2025-399469.8 CRÍ95.7%
——29In the Linux kernel, the following vulnerability has been resolved:
tls: make sure to abort the stream if headers are bogus
Normally we wait for the socket to buffer up the whole record
before we service it. If the socket has a tiny buffer, however,
we read out the data sooner, to prevent connection stalls.
Make sure that we abort the connection when we find out late
that the record is actually invalid. Retrying the parsing is
fine in itself but since we copy some more data each time
before we parse we can overflow the allocated skb space.
Constructing a scenario in which we're under pressure without
enough data in the socket to parse the length upfront is quite
hard. syzbot figured out a way to do this by serving us the header
in small OOB sends, and then filling in the recvbuf with a large
normal send.
Make sure that tls_rx_msg_size() aborts strp, if we reach
an invalid record there's really no way to recover.19dCVE-2019-9922—95.7%
——29——CVE-2023-369007.8 ALT95.7%
——29Windows Common Log File System Driver Elevation of Privilege Vulnerability89dCVE-2017-5611—95.7%
——29——CVE-2013-6236—95.7%
——29——CVE-2013-4579—95.7%
——29——CVE-2007-0746—95.7%
——29——CVE-2007-2498—95.7%
——29——