Vulnerabilidades explotables hoy
350,515en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,651
Nuevos KEV · 24H4
Exploit Today ≥ 701,587
Distribución · última ventana
- Crítico1,541
- Alto5,045
- Medio4,141
- Bajo344
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-4217—0.9%
——0——CVE-2023-42696—0.9%
——0——CVE-2022-42501—0.9%
——0——CVE-2022-42502—0.9%
——0——CVE-2024-58047—0.9%
——0——CVE-2025-40583—0.9%
——0——CVE-2022-26426—0.9%
——0——CVE-2026-531975.5 MED0.9%
——0In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()
iptfs_destroy_state() calls hrtimer_cancel() while holding a spinlock
that the timer callback also acquires, leading to an ABBA deadlock on
SMP systems.
For the output timer (iptfs_timer):
- iptfs_destroy_state() holds x->lock, calls hrtimer_cancel()
- iptfs_delay_timer() callback takes x->lock
For the drop timer (drop_timer):
- iptfs_destroy_state() holds drop_lock, calls hrtimer_cancel()
- iptfs_drop_timer() callback takes drop_lock
Both timers use HRTIMER_MODE_REL_SOFT, so their callbacks run in softirq
context. When hrtimer_cancel() is called for a soft timer that is
currently executing on another CPU, hrtimer_cancel_wait_running() spins
on softirq_expiry_lock -- the same lock held by the softirq running the
callback. If the callback is blocked waiting for the spinlock held by
the caller of hrtimer_cancel(), a circular dependency forms:
CPU 0: holds lock_A -> waits for softirq_expiry_lock
CPU 1: holds softirq_expiry_lock -> waits for lock_A
Fix by calling hrtimer_cancel() before acquiring the respective locks.
hrtimer_cancel() is safe to call without holding any lock and will wait
for any in-progress callback to complete. For the output timer, the
lock is still acquired afterwards to drain the packet queue. For the
drop timer, the lock/unlock pair is removed entirely since it only
existed to serialize with the timer callback, which hrtimer_cancel()
already guarantees.
Found by source code audit.15dCVE-2022-39899—0.9%
——0——CVE-2026-149713.9 BAJ0.9%
——0IBM PowerVM Novalink 2.2.02.2.12.2.1.1, and 2.3.02.3.0.12.3.12.3.2 IBM NovaLink APIs misconfiguration may increase attack surface and enable unintended or unauthorized operations under non-default conditions.1dCVE-2021-0366—0.9%
——0——CVE-2023-20605—0.9%
——0——CVE-2023-20606—0.9%
——0——CVE-2023-42690—0.9%
——0——CVE-2021-0367—0.9%
——0——CVE-2021-0401—0.9%
——0——CVE-2026-46058—0.9%
——0——CVE-2021-0387—0.9%
——0——CVE-2022-20355—0.9%
——0——CVE-2023-21042—0.9%
——0——CVE-2023-21043—0.9%
——0——CVE-2025-22404—0.9%
——0——CVE-2025-30669—0.9%
——0——CVE-2026-44278—0.9%
——0——CVE-2025-64740—0.9%
——0——CVE-2023-43517—0.9%
——0——CVE-2024-43089—0.9%
——0——CVE-2026-34126—0.9%
——0——CVE-2023-21338—0.9%
——0——CVE-2022-28783—0.9%
——0——CVE-2026-24374—0.9%
——0——CVE-2022-26459—0.9%
——0——CVE-2023-24844—0.9%
——0——CVE-2023-42692—0.9%
——0——CVE-2023-21204—0.9%
——0——CVE-2025-9317—0.9%
——0——CVE-2026-24384—0.9%
——0——CVE-2023-21046—0.9%
——0——CVE-2023-42695—0.9%
——0——CVE-2023-42691—0.9%
——0——