Vulnerabilidades explotables hoy
413,525en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,779
Nuevos KEV · 24H0
Exploit Today ≥ 701,707
Distribución · última ventana
- Crítico5,739
- Alto22,705
- Medio21,204
- Bajo2,175
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2001-0596—95.2%
——29——CVE-2001-1199—95.2%
——29——CVE-2020-7593—95.2%
——29——CVE-2019-7801—95.2%
——29——CVE-2019-1138—95.2%
——29——CVE-2011-2764—95.2%
——29——CVE-2026-4508710.0 CRÍ95.2%
——29Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options — including FoundAction and FoundActionShell — is deserialized directly from attacker-supplied JSON in POST /scan, and because dalfox.Initialize explicitly propagates those two fields into the final scan options without stripping them, any unauthenticated caller who can reach the server port can supply an arbitrary shell command that the dalfox process will execute on the host whenever a scan finding is triggered. This vulnerability is fixed in 2.13.0.17dCVE-2017-8753—95.2%
——29——CVE-2004-2760—95.2%
——29——CVE-2006-3423—95.2%
——29——CVE-2020-0833—95.2%
——29——CVE-2017-11274—95.2%
——29——CVE-2008-3159—95.2%
——29——CVE-2023-39751—95.2%
——29——CVE-2010-1313—95.2%
——29——CVE-2022-20140—95.2%
——29——CVE-2017-3084—95.2%
——29——CVE-2003-0470—95.2%
——29——CVE-2007-6333—95.2%
——29——CVE-2017-8756—95.2%
——29——CVE-2012-1614—95.2%
——29——CVE-2021-39433—95.2%
——29——CVE-2007-1735—95.2%
——29——CVE-2026-426004.9 MED95.2%
——29MinIO is a high-performance object storage system. From RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z, A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configured drive roots, bounded only by the MinIO process UID. The attacker sends POST minio/storage/{drivePath}/v63/rmpl with a msgpack-encoded body carrying ../ sequences in the Bucket field. The server opens the resulting path via os.OpenFile with O_RDONLY|O_NOATIME and returns its contents in the msgpack response stream. This vulnerability is fixed in RELEASE.2026-04-14T21-32-45Z.9hCVE-2016-0868—95.2%
——29——CVE-2019-1464—95.2%
——29——CVE-1999-0147—95.2%
——29——CVE-2016-5678—95.2%
——29——CVE-2011-1475—95.2%
——29——CVE-2024-30163—95.2%
——29——CVE-2019-15943—95.2%
——29——CVE-2019-7799—95.2%
——29——CVE-2014-6326—95.2%
——29——CVE-2019-1237—95.2%
——29——CVE-2008-4343—95.2%
——29——CVE-2011-4914—95.2%
——29——CVE-2023-34105—95.2%
——29——CVE-2019-0560—95.2%
——29——CVE-2007-5289—95.2%
——29——CVE-2021-21125—95.2%
——29——