Vulnerabilidades explotables hoy
413,655en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,779
Nuevos KEV · 24H0
Exploit Today ≥ 701,707
Distribución · última ventana
- Crítico5,615
- Alto22,424
- Medio20,905
- Bajo2,130
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2014-0604—93.7%
——28——CVE-2015-0839—93.7%
——28——CVE-2017-17458—93.7%
——28——CVE-2018-12232—93.7%
——28——CVE-2020-3799—93.7%
——28——CVE-2016-1039—93.7%
——28——CVE-2008-1887—93.7%
——28——CVE-2005-0513—93.7%
——28——CVE-2013-1636—93.7%
——28——CVE-2026-2621610.0 CRÍ93.7%
——28Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows full server compromise, including arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks.35dCVE-2007-6041—93.7%
——28——CVE-2005-3389—93.7%
——28——CVE-2024-48455—93.7%
——28——CVE-2019-8928—93.7%
——28——CVE-2017-7039—93.7%
——28——CVE-2011-3375—93.7%
——28——CVE-2013-0150—93.7%
——28——CVE-2020-9655—93.7%
——28——CVE-2005-1006—93.7%
——28——CVE-2015-1831—93.7%
——28——CVE-2017-7043—93.7%
——28——CVE-2025-2284—93.7%
——28——CVE-2022-28915—93.7%
——28——CVE-2006-5273—93.7%
——28——CVE-2020-1036—93.7%
——28——CVE-2026-111229—93.7%
——28Rejected reason: This CVE ID has been rejected because it does not describe a security vulnerability.6dCVE-2015-7977—93.7%
——28——CVE-2020-363278.8 ALT93.7%
——28Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.35dCVE-2008-6535—93.7%
——28——CVE-2020-3807—93.7%
——28——CVE-2008-3486—93.7%
——28——CVE-2018-3615—93.7%
——28——CVE-2002-1215—93.7%
——28——CVE-2018-15536—93.7%
——28——CVE-2020-1018—93.7%
——28——CVE-2002-0388—93.7%
——28——CVE-2017-15099—93.7%
——28——CVE-2013-4864—93.7%
——28——CVE-2026-425338.1 ALT93.7%
——28A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.9dCVE-2001-0778—93.7%
——28——