Vulnerabilidades explotables hoy
351,736en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,651
Nuevos KEV · 24H0
Exploit Today ≥ 701,587
Distribución · última ventana
- Crítico1,781
- Alto5,774
- Medio4,665
- Bajo440
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2025-7841—1.2%
——0——CVE-2023-53310—1.2%
——0——CVE-2024-45543—1.2%
——0——CVE-2024-33031—1.2%
——0——CVE-2024-24692—1.2%
——0——CVE-2021-25392—1.2%
——0——CVE-2022-21747—1.2%
——0——CVE-2022-21746—1.2%
——0——CVE-2025-22493—1.2%
——0——CVE-2025-14734—1.2%
——0——CVE-2024-23715—1.1%
——0——CVE-2026-9721—1.2%
——0——CVE-2021-25382—1.2%
——0——CVE-2026-24920—1.2%
——0——CVE-2021-25411—1.2%
——0——CVE-2024-38424—1.2%
——0——CVE-2024-38422—1.2%
——0——CVE-2023-21105—1.2%
——0——CVE-2024-38423—1.1%
——0——CVE-2022-26471—1.2%
——0——CVE-2022-20182—1.2%
——0——CVE-2026-0035—1.2%
——0——CVE-2024-20107—1.2%
——0——CVE-2025-13905—1.2%
——0——CVE-2022-33721—1.2%
——0——CVE-2026-0005—1.2%
——0——CVE-2024-21469—1.2%
——0——CVE-2025-62986—1.2%
——0——CVE-2024-33029—1.2%
——0——CVE-2024-33038—1.2%
——0——CVE-2023-43542—1.2%
——0——CVE-2024-23386—1.2%
——0——CVE-2023-21291—1.2%
——0——CVE-2026-106717.1 ALT1.2%
——0In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kernel/pipe.c used K_SYSCALL_OBJ() (which requires the kernel object to already be initialized) instead of K_SYSCALL_OBJ_NEVER_INIT() (which rejects an already-initialized object). As a result, on CONFIG_USERSPACE builds an unprivileged user thread that has been granted access to a k_pipe object can invoke the k_pipe_init syscall to re-initialize a pipe that is already in use.
z_impl_k_pipe_init() unconditionally resets the ring buffer, sets pipe->waiting to 0, and re-initializes both wait queues (z_waitq_init on pipe->data and pipe->space) without waking or accounting for threads currently blocked on the pipe. Any thread already pended in k_pipe_read()/k_pipe_write() is left orphaned: still marked pending with pended_on pointing at the cleared wait queue and with stale qnode_dlist links into the (now re-initialized) embedded list head.
When such an orphaned waiter is later timed out or woken, the scheduler calls sys_dlist_remove() on its stale node, writing through dangling prev/next pointers into kernel wait-queue/scheduler structures, causing list corruption (an attacker-driven invalid kernel write), lost wakeups, indefinitely blocked threads, and silent data loss. The flaw lets a deprivileged user thread corrupt the state of a kernel object shared with other threads/partitions.
The fix switches the verifier to K_SYSCALL_OBJ_NEVER_INIT(), matching the existing k_msgq_init verifier, so a user thread can no longer re-initialize a live pipe. The vulnerable code shipped in v4.1.0 and remained through v4.4.0.8dCVE-2026-2401—1.2%
——0——CVE-2024-31332—1.2%
——0——CVE-2026-8340—1.2%
——0——CVE-2024-38409—1.2%
——0——CVE-2025-27711—1.2%
——0——CVE-2026-31700—1.2%
——0——