Vulnerabilidades explotables hoy
413,805en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,779
Nuevos KEV · 24H0
Exploit Today ≥ 701,707
Distribución · última ventana
- Crítico5,596
- Alto22,468
- Medio20,787
- Bajo2,126
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2015-5253—93.1%
——28——CVE-2016-4997—93.1%
——28——CVE-2013-2436—93.1%
——28——CVE-2017-8857—93.1%
——28——CVE-2016-3505—93.1%
——28——CVE-2026-441949.1 CRÍ93.1%
——28OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8.17dCVE-2018-4193—93.1%
——28——CVE-2018-11804—93.1%
——28——CVE-2014-0871—93.1%
——28——CVE-2007-6558—93.1%
——28——CVE-2026-76085.5 MED93.1%
——28A vulnerability was detected in TRENDnet TEW-821DAP up to 1.12B01. The affected element is the function tools_diagnostic. The manipulation results in os command injection. The exploit is now public and may be used. The vendor explains: "That firmware version will only work on our hardware version v1.xR. We have already EOL that product 8 years ago and are no longer selling". This vulnerability only affects products that are no longer supported by the maintainer.17dCVE-2004-2061—93.1%
——28——CVE-2006-7127—93.1%
——28——CVE-2009-2183—93.1%
——28——CVE-2024-0300—93.1%
——28——CVE-2017-14632—93.1%
——28——CVE-2023-28133—93.1%
——28——CVE-2008-0965—93.1%
——28——CVE-2009-3831—93.1%
——28——CVE-2016-7401—93.1%
——28——CVE-2009-0894—93.1%
——28——CVE-2014-6491—93.1%
——28——CVE-2011-0565—93.1%
——28——CVE-2014-6048—93.1%
——28——CVE-2018-19708—93.1%
——28——CVE-2018-19707—93.1%
——28——CVE-2002-0901—93.1%
——28——CVE-2019-19650—93.1%
——28——CVE-2011-0502—93.1%
——28——CVE-2004-0418—93.1%
——28——CVE-2014-0492—93.1%
——28——CVE-2026-20139—93.1%
——28——CVE-2019-11062—93.1%
——28——CVE-2010-4647—93.1%
——28——CVE-2021-301209.9 CRÍ93.1%
——28Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in.91dCVE-2009-2112—93.1%
——28——CVE-2006-2814—93.1%
——28——CVE-2009-2935—93.1%
——28——CVE-2018-8865—93.1%
——28——CVE-2009-2981—93.1%
——28——