Vulnerabilidades explotables hoy
368,208en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,694
Nuevos KEV · 24H0
Exploit Today ≥ 701,631
Distribución · última ventana
- Crítico2,147
- Alto7,679
- Medio5,506
- Bajo542
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2025-54674—4.0%
——1——CVE-2023-53583—4.0%
——1——CVE-2025-39351—4.0%
——1——CVE-2026-90858.8 ALT4.0%
——1Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control allows DNS Spoofing.
This issue affects Pardus-Parental-Control: from <=0.5.1 before 0.7.0.59dCVE-2025-55047—4.0%
——1——CVE-2022-50533—4.0%
——1——CVE-2026-451967.8 ALT4.0%
——1Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access which can lead to privilege escalation.22dCVE-2025-47674—4.0%
——1——CVE-2025-39722—4.0%
——1——CVE-2023-53251—4.0%
——1——CVE-2025-2265—4.0%
——1——CVE-2025-60164—4.0%
——1——CVE-2022-50927—4.0%
——1——CVE-2024-22430—4.0%
——1——CVE-2020-0308—4.0%
——1——CVE-2024-29980—4.0%
——1——CVE-2023-28046—4.0%
——1——CVE-2026-332765.4 MED4.0%
——1Stored cross-site scripting (XSS) in Checkmk 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create hosts or services to execute arbitrary JavaScript in the browsers of other users performing searches in the Unified Search feature.41dCVE-2026-143316.1 MED4.0%
——1The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link.8dCVE-2025-10581—4.0%
——1——CVE-2020-36903—4.0%
——1——CVE-2026-742474.2 MED4.0%
——1A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.14dCVE-2025-218277.8 ALT4.0%
——1In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()
The documentation for usb_driver_claim_interface() says that "the
device lock" is needed when the function is called from places other
than probe(). This appears to be the lock for the USB interface
device. The Mediatek btusb code gets called via this path:
Workqueue: hci0 hci_power_on [bluetooth]
Call trace:
usb_driver_claim_interface
btusb_mtk_claim_iso_intf
btusb_mtk_setup
hci_dev_open_sync
hci_power_on
process_scheduled_works
worker_thread
kthread
With the above call trace the device lock hasn't been claimed. Claim
it.
Without this fix, we'd sometimes see the error "Failed to claim iso
interface". Sometimes we'd even see worse errors, like a NULL pointer
dereference (where `intf->dev.driver` was NULL) with a trace like:
Call trace:
usb_suspend_both
usb_runtime_suspend
__rpm_callback
rpm_suspend
pm_runtime_work
process_scheduled_works
Both errors appear to be fixed with the proper locking.36dCVE-2020-0473—4.0%
——1——CVE-2026-149226.1 MED4.0%
——1WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline. On write, `wppa_do_comment()` sanitizes the comment with `wppa_filter_html()` (wp_kses) followed by `wp_strip_all_tags()` (`wppa-functions.php:2623-2624`). Because `wp_strip_all_tags()` only removes *real* tags, an attacker who submits a **double HTML-entity-encoded** payload (e.g. `&lt;img src=... onload=...&gt;`) passes the write filters as harmless entity text and is stored one decode-level down (`<img ... onload=...>`).8dCVE-2024-20873—4.0%
——1——CVE-2026-238685.1 MED4.0%
——1Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible.51dCVE-2026-02767.8 ALT4.0%
——1A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user.50dCVE-2023-53292—4.0%
——1——CVE-2026-99864.2 MED4.0%
——1Insufficient validation of untrusted input in OptimizationGuide in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)45dCVE-2024-43705—4.0%
——1——CVE-2023-22351—4.0%
——1——CVE-2024-36262—4.0%
——1——CVE-2025-53329—4.0%
——1——CVE-2026-23411—4.0%
——1——CVE-2025-54673—4.0%
——1——CVE-2025-156786.1 MED4.0%
——1The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default), allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site Scripting.8dCVE-2022-50524—4.0%
——1——CVE-2020-0077—4.0%
——1——CVE-2023-31020—4.0%
——1——