Vulnerabilidades explotables hoy
413,612en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,779
Nuevos KEV · 24H0
Exploit Today ≥ 701,707
Distribución · última ventana
- Crítico5,712
- Alto22,677
- Medio21,178
- Bajo2,161
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2001-0780—94.5%
——28——CVE-2025-52436—94.5%
——28——CVE-2014-8141—94.5%
——28——CVE-2009-1391—94.5%
——28——CVE-2009-0196—94.5%
——28——CVE-2025-02445.3 MED94.5%
——28When redirecting to an invalid protocol scheme, an attacker could spoof the address bar.
*Note: This issue only affected Android operating systems. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 134.38dCVE-2011-1984—94.5%
——28——CVE-2012-4708—94.5%
——28——CVE-2015-4816—94.5%
——28——CVE-2004-1926—94.5%
——28——CVE-2006-1044—94.5%
——28——CVE-2007-0613—94.5%
——28——CVE-2014-3673—94.5%
——28——CVE-2022-45980—94.5%
——28——CVE-2007-3641—94.5%
——28——CVE-2022-40146—94.5%
——28——CVE-2015-5754—94.5%
——28——CVE-2021-25829—94.5%
——28——CVE-2005-0635—94.5%
——28——CVE-2000-0331—94.5%
——28——CVE-2018-14013—94.5%
——28——CVE-2021-406907.5 ALT94.5%
——28All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.35dCVE-2026-54069—94.5%
——28SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication. Combined with the default empty AccessAuthCode on desktop installs, any Chrome/Chromium extension -- including a compromised legitimate extension via supply chain attack -- can make fully authenticated admin API calls to the SiYuan kernel at 127.0.0.1:6806, enabling data exfiltration, stored XSS injection, and configuration tampering. This vulnerability is fixed in 3.7.0.17dCVE-2014-8139—94.5%
——28——CVE-2021-31537—94.5%
——28——CVE-2011-2109—94.5%
——28——CVE-2002-0240—94.5%
——28——CVE-2022-31846—94.5%
——28——CVE-2010-2183—94.5%
——28——CVE-2001-0215—94.5%
——28——CVE-2025-2701—94.5%
——28——CVE-2018-12808—94.5%
——28——CVE-2006-5911—94.5%
——28——CVE-2001-0262—94.5%
——28——CVE-2007-3360—94.5%
——28——CVE-2007-4223—94.5%
——28——CVE-2025-625078.8 ALT94.5%
——28Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.24dCVE-1999-0842—94.5%
——28——CVE-2009-2256—94.5%
——28——CVE-2010-2173—94.5%
——28——