Vulnerabilidades explotables hoy
368,208en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,694
Nuevos KEV · 24H0
Exploit Today ≥ 701,631
Distribución · última ventana
- Crítico2,146
- Alto7,677
- Medio5,510
- Bajo543
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2024-21840—3.9%
——1——CVE-2024-36976—3.9%
——1——CVE-2026-6521—3.9%
——1——CVE-2025-20052—3.9%
——1——CVE-2024-51764—3.9%
——1——CVE-2023-20919—3.9%
——1——CVE-2025-71176—3.9%
——1——CVE-2023-52556—3.9%
——1——CVE-2026-25812—3.9%
——1——CVE-2026-396409.6 CRÍ3.9%
——1Cross-Site Request Forgery (CSRF) vulnerability in mndpsingh287 Theme Editor theme-editor allows Code Injection.This issue affects Theme Editor: from n/a through <= 3.2.41dCVE-2024-28044—3.9%
——1——CVE-2026-396218.8 ALT3.9%
——1Cross-Site Request Forgery (CSRF) vulnerability in spicethemes SpicePress spicepress allows Upload a Web Shell to a Web Server.This issue affects SpicePress: from n/a through <= 2.3.2.5.41dCVE-2020-12614—3.9%
——1——CVE-2026-30904—3.9%
——1——CVE-2026-396179.6 CRÍ3.9%
——1Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Bluestreet bluestreet allows Cross Site Request Forgery.This issue affects Bluestreet: from n/a through <= 1.7.3.41dCVE-2026-464327.8 ALT3.9%
——1LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, LMDeploy is vulnerable to arbitrary code execution through hardcoded "trust_remote_code=True" in multiple HuggingFace model-loading call sites. At time of publication, there are no publicly available patches.43dCVE-2024-45723—3.9%
——1——CVE-2026-46150—3.9%
——1——CVE-2023-21133—3.8%
——1——CVE-2026-646173.8 BAJ3.8%
——1Data::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in pubsub.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.42dCVE-2025-31438—3.8%
——1——CVE-2023-536697.8 ALT3.8%
——1In the Linux kernel, the following vulnerability has been resolved:
tcp: fix skb_copy_ubufs() vs BIG TCP
David Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy
using hugepages, and skb length bigger than ~68 KB.
skb_copy_ubufs() assumed it could copy all payload using up to
MAX_SKB_FRAGS order-0 pages.
This assumption broke when BIG TCP was able to put up to 512 KB per skb.
We did not hit this bug at Google because we use CONFIG_MAX_SKB_FRAGS=45
and limit gso_max_size to 180000.
A solution is to use higher order pages if needed.
v2: add missing __GFP_COMP, or we leak memory.31dCVE-2020-0208—3.8%
——1——CVE-2023-21671—3.8%
——1——CVE-2026-664084.6 MED3.8%
——1The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords.
Physical access to an affected product may allow to obtain the password of the root account.6dCVE-2026-219533.3 BAJ3.8%
——1Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xstore Mobile). The supported version that is affected is 21.0.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Retail Xstore Point of Service executes to compromise Oracle Retail Xstore Point of Service. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).27dCVE-2025-35031—3.8%
——1——CVE-2023-21132—3.8%
——1——CVE-2022-20416—3.8%
——1——CVE-2026-632814.8 MED3.8%
——1Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/JavaScript in administrator summaries.38dCVE-2025-20891—3.8%
——1——CVE-2026-272165.5 MED3.8%
——1Substance3D - Painter versions 11.1.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.7dCVE-2021-1918—3.8%
——1——CVE-2025-52926—3.8%
——1——CVE-2024-38301—3.8%
——1——CVE-2023-45793—3.8%
——1——CVE-2023-33053—3.8%
——1——CVE-2025-70347—3.8%
——1——CVE-2025-25154—3.8%
——1——CVE-2025-20938—3.8%
——1——