Vulnerabilidades explotables hoy
413,525en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,779
Nuevos KEV · 24H0
Exploit Today ≥ 701,707
Distribución · última ventana
- Crítico5,739
- Alto22,705
- Medio21,204
- Bajo2,175
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2012-1530—95.1%
——29——CVE-2024-48459—95.1%
——29——CVE-2010-3306—95.1%
——29——CVE-2017-11883—95.1%
——29——CVE-2007-0684—95.1%
——29——CVE-2026-408717.2 ALT95.1%
——29mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the quarantine_category field via the Mailcow API. The /api/v1/add/mailbox endpoint stores quarantine_category without validation or sanitization. This value is later used by quarantine_notify.py, which constructs SQL queries using unsafe % string formatting instead of parameterized queries. This results in a delayed (second-order) SQL injection when the quarantine notification job executes, allowing an attacker to inject arbitrary SQL. Using a UNION SELECT, sensitive data (e.g., admin credentials) can be exfiltrated and rendered inside quarantine notification emails. Version 2026-03b fixes the vulnerability.16dCVE-2020-22210—95.1%
——29——CVE-2008-0379—95.1%
——29——CVE-2018-5009—95.1%
——29——CVE-2000-0508—95.1%
——29——CVE-2022-03917.5 ALT95.1%
——29A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.29dCVE-2013-0649—95.1%
——29——CVE-2009-4501—95.1%
——29——CVE-2006-3970—95.1%
——29——CVE-2006-0888—95.1%
——29——CVE-1999-1537—95.1%
——29——CVE-2018-11505—95.1%
——29——CVE-2012-5209—95.1%
——29——CVE-2003-0651—95.1%
——29——CVE-2009-3603—95.1%
——29——CVE-2007-0851—95.1%
——29——CVE-2003-0564—95.1%
——29——CVE-2007-2364—95.1%
——29——CVE-2021-411836.5 MED95.1%
——29jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.79dCVE-2008-0127—95.1%
——29——CVE-2023-46842—95.1%
——29——CVE-2008-6833—95.1%
——29——CVE-2019-12170—95.1%
——29——CVE-2017-2800—95.1%
——29——CVE-2014-0242—95.1%
——29——CVE-2021-30175—95.1%
——29——CVE-2001-13767.5 SIN95.1%
——29Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via shared secret data.5hCVE-2010-0444—95.1%
——29——CVE-2012-5835—95.1%
——29——CVE-2020-10564—95.1%
——29——CVE-2010-1685—95.1%
——29——CVE-2014-7981—95.1%
——29——CVE-2010-1132—95.1%
——29——CVE-2017-4947—95.1%
——29——CVE-2019-10989—95.1%
——29——