Vulnerabilidades explotables hoy
414,784en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,781
Nuevos KEV · 24H0
Exploit Today ≥ 701,709
Distribución · última ventana
- Crítico5,286
- Alto20,850
- Medio19,532
- Bajo2,048
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2016-4485—91.9%
——28——CVE-2022-14737.5 ALT91.9%
——28The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).32dCVE-2021-459608.8 ALT91.9%
——28In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).32dCVE-2019-193179.8 CRÍ91.9%
——28lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.32dCVE-2016-5418—91.9%
——28——CVE-2017-1000190—91.9%
——28——CVE-2002-1854—91.9%
——28——CVE-2008-3537—91.9%
——28——CVE-2011-3324—91.9%
——28——CVE-2014-9608—91.9%
——28——CVE-2006-4806—91.9%
——28——CVE-2025-22467—91.9%
——28——CVE-2011-2214—91.9%
——28——CVE-2013-4125—91.9%
——28——CVE-2018-2663—91.9%
——28——CVE-2017-13748—91.9%
——28——CVE-2003-0632—91.9%
——28——CVE-2021-369658.8 ALT91.9%
——28Windows WLAN AutoConfig Service Remote Code Execution Vulnerability97dCVE-2015-8728—91.9%
——28——CVE-2006-3292—91.9%
——28——CVE-2009-3609—91.9%
——28——CVE-2020-10374—91.9%
——28——CVE-2001-0180—91.9%
——28——CVE-2021-29943—91.9%
——28——CVE-2020-1319—91.9%
——28——CVE-2023-6318—91.9%
——28——CVE-2024-34982—91.9%
——28——CVE-2003-1115—91.9%
——28——CVE-2018-0976—91.9%
——28——CVE-2017-6371—91.9%
——28——CVE-2012-4655—91.9%
——28——CVE-2023-21607—91.9%
——28——CVE-2018-1000134—91.9%
——28——CVE-2026-1008528.8 ALT91.9%
——28AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell metacharacters and trigger command execution as the Liquidsoap process user when recording closes.48dCVE-2025-113354.7 MED91.9%
——28A weakness has been identified in D-Link DI-7100G C1 up to 20250928. Affected by this vulnerability is the function sub_46409C of the file /msp_info.htm?flag=qos of the component jhttpd. This manipulation of the argument iface causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.37dCVE-2010-4348—91.9%
——28——CVE-2008-3583—91.9%
——28——CVE-2018-17963—91.9%
——28——CVE-2012-1181—91.9%
——28——CVE-2018-12842—91.9%
——28——