Vulnerabilidades explotables hoy
412,645en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,779
Nuevos KEV · 24H0
Exploit Today ≥ 701,703
Distribución · última ventana
- Crítico5,634
- Alto22,161
- Medio20,546
- Bajo2,120
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2018-0959—95.6%
——29——CVE-2014-9028—95.6%
——29——CVE-1999-1110—95.6%
——29——CVE-2025-28145—95.6%
——29——CVE-2020-14625—95.6%
——29——CVE-2015-5161—95.6%
——29——CVE-2013-1777—95.6%
——29——CVE-1999-0490—95.6%
——29——CVE-2022-23626—95.6%
——29——CVE-2000-0594—95.6%
——29——CVE-2025-49724—95.6%
——29——CVE-2004-0631—95.6%
——29——CVE-2009-3705—95.6%
——29——CVE-2018-25120—95.6%
——29——CVE-2019-6739—95.6%
——29——CVE-2008-3680—95.6%
——29——CVE-2019-1335—95.6%
——29——CVE-2016-4055—95.6%
——29——CVE-1999-0935—95.6%
——29——CVE-2025-429289.1 CRÍ95.6%
——29Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may be vulnerable when specially crafted input is used to exploit the vulnerability resulting in high impact on confidentiality, integrity and availability of the system.34dCVE-2020-16915—95.6%
——29——CVE-2021-33909—95.6%
——29——CVE-2016-0779—95.6%
——29——CVE-2015-6037—95.6%
——29——CVE-2022-27793—95.6%
——29——CVE-2016-5699—95.6%
——29——CVE-2011-0014—95.6%
——29——CVE-2026-62799.8 CRÍ95.6%
——29The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the `wp_conditional_tags` case in `Fusion_Builder_Conditional_Render_Helper::get_value()` passing attacker-controlled values from a base64-decoded JSON blob directly to `call_user_func()` without any allowlist validation. This is exploitable by unauthenticated attackers through the `fusion_get_widget_markup` AJAX endpoint, which is registered for non-privileged (unauthenticated) users via `wp_ajax_nopriv_fusion_get_widget_markup`. The endpoint is protected only by a nonce (`fusion_load_nonce`), but this nonce is generated for user ID 0 and is deterministically exposed in the JavaScript output of any public-facing page containing a Post Cards (`[fusion_post_cards]`) or Table of Contents (`[fusion_table_of_contents]`) element. This makes it possible for unauthenticated attackers to execute arbitrary code on affected sites.110dCVE-2015-6668—95.6%
——29——CVE-2022-38840—95.6%
——29——CVE-2018-8609—95.6%
——29——CVE-2025-28142—95.6%
——29——CVE-2012-3213—95.6%
——29——CVE-2018-0598—95.6%
——29——CVE-2019-1674—95.6%
——29——CVE-2015-7978—95.6%
——29——CVE-2009-0304—95.6%
——29——CVE-2018-1002208—95.6%
——29——CVE-2022-44366—95.6%
——29——CVE-2022-0948—95.6%
——29——