Vulnerabilidades explotables hoy
368,208en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,694
Nuevos KEV · 24H0
Exploit Today ≥ 701,631
Distribución · última ventana
- Crítico2,146
- Alto7,677
- Medio5,506
- Bajo542
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2024-34608—3.9%
——1——CVE-2026-217844.8 MED3.9%
——1HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation.6dCVE-2024-6619—3.9%
——1——CVE-2023-53099—3.9%
——1——CVE-2025-0432—3.9%
——1——CVE-2026-25570—3.9%
——1——CVE-2024-41917—3.9%
——1——CVE-2025-1246—3.9%
——1——CVE-2026-400317.8 ALT3.9%
——1MemProcFS before 5.17 contains multiple unsafe library-loading patterns that enable DLL and shared-library hijacking across six attack surfaces, including bare-name LoadLibraryU and dlopen calls without path qualification for vmmpyc, libMSCompression, and plugin DLLs. An attacker who places a malicious DLL or shared library in the working directory or manipulates LD_LIBRARY_PATH can achieve arbitrary code execution when MemProcFS loads.41dCVE-2024-10228—3.9%
——1——CVE-2026-493182.4 BAJ3.9%
——1Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the PIN entry screen. The Infotainment uses presence of Wireless Control Module (WCM) traffic during its boot window as a proxy for whether an immobilizer is fitted; if no WCM messages are observed, it skips the PIN entry screen and shows the normal user interface. An attacker who silences the WCM during the boot window — for example via a separately tracked CAN bus-off technique — can present a fully unlocked Infotainment despite the PIN never being entered. Specific timing and protocol details have been withheld pending vendor remediation.45dCVE-2026-112786.5 MED3.9%
——1Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)43dCVE-2025-68140—3.9%
——1——CVE-2026-314477.8 ALT3.9%
——1In the Linux kernel, the following vulnerability has been resolved:
ext4: reject mount if bigalloc with s_first_data_block != 0
bigalloc with s_first_data_block != 0 is not supported, reject mounting
it.51dCVE-2026-21443—3.9%
——1——CVE-2022-50688—3.9%
——1——CVE-2021-21547—3.9%
——1——CVE-2026-743838.4 ALT3.9%
——1In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools
nvme_setup_descriptor_pools() indexes dev->descriptor_pools[] using the
numa_node forwarded from hctx->numa_node by its single caller,
nvme_init_hctx_common(). On a non-NUMA kernel hctx->numa_node is
NUMA_NO_NODE (-1). Because the parameter was declared 'unsigned', the
value becomes UINT_MAX and the index walks off the array (sized to
nr_node_ids), faulting during nvme_alloc_ns() and leaving the namespace
without a /dev node.
Reproduces on any NVMe controller probed by a CONFIG_NUMA=n kernel:
BUG: unable to handle page fault for address: ffff889101603d38
RIP: 0010:nvme_init_hctx_common+0x5a/0x190 [nvme]
Call Trace:
nvme_init_hctx+0x10/0x20 [nvme]
nvme_alloc_ns+0x9e/0xa10 [nvme_core]
nvme_scan_ns+0x301/0x3b0 [nvme_core]
nvme_scan_ns_async+0x23/0x30 [nvme_core]
Switch the parameter to int and fall back to node 0 when it is
NUMA_NO_NODE; node 0 is always present.18dCVE-2024-45382—3.9%
——1——CVE-2024-32915—3.9%
——1——CVE-2023-53206—3.9%
——1——CVE-2018-11983—3.9%
——1——CVE-2025-220604.7 MED3.9%
——1In the Linux kernel, the following vulnerability has been resolved:
net: mvpp2: Prevent parser TCAM memory corruption
Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM
information, from concurrent modifications.
Both the TCAM and SRAM tables are indirectly accessed by configuring
an index register that selects the row to read or write to. This means
that operations must be atomic in order to, e.g., avoid spreading
writes across multiple rows. Since the shadow SRAM array is used to
find free rows in the hardware table, it must also be protected in
order to avoid TOCTOU errors where multiple cores allocate the same
row.
This issue was detected in a situation where `mvpp2_set_rx_mode()` ran
concurrently on two CPUs. In this particular case the
MVPP2_PE_MAC_UC_PROMISCUOUS entry was corrupted, causing the
classifier unit to drop all incoming unicast - indicated by the
`rx_classifier_drops` counter.51dCVE-2024-45328—3.9%
——1——CVE-2024-30154—3.9%
——1——CVE-2025-38496—3.9%
——1——CVE-2026-28044—3.9%
——1——CVE-2026-9676—3.9%
——1——CVE-2026-31780—3.9%
——1——CVE-2026-28357—3.9%
——1——CVE-2021-30263—3.9%
——1——CVE-2026-180104.3 MED3.9%
——1Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)31dCVE-2026-23178—3.9%
——1——CVE-2024-36976—3.9%
——1——CVE-2022-45874—3.9%
——1——CVE-2026-28398—3.9%
——1——CVE-2024-21840—3.9%
——1——CVE-2025-0360—3.9%
——1——CVE-2024-34605—3.9%
——1——CVE-2026-493172.4 BAJ3.9%
——1Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the PIN entry screen. The Infotainment uses presence of Wireless Control Module (WCM) traffic during its boot window as a proxy for whether an immobilizer is fitted; if no WCM messages are observed, it skips the PIN entry screen and shows the normal user interface. An attacker who silences the WCM during the boot window — for example via a separately tracked CAN bus-off technique — can present a fully unlocked Infotainment despite the PIN never being entered. Specific timing and protocol details have been withheld pending vendor remediation.45d