Vulnerabilidades explotables hoy
367,851en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,687
Nuevos KEV · 24H0
Exploit Today ≥ 701,629
Distribución · última ventana
- Crítico2,393
- Alto9,631
- Medio5,587
- Bajo548
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-188448.1 ALT3.1%
——1The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on.21dCVE-2021-0973—3.1%
——1——CVE-2024-34613—3.1%
——1——CVE-2020-8939—3.1%
——1——CVE-2021-39619—3.1%
——1——CVE-2026-419826.4 MED3.1%
——1Race condition vulnerability in the IPC module. Impact: Successful exploitation of this vulnerability may affect availability.41dCVE-2025-59904—3.1%
——1——CVE-2026-730476.2 MED3.1%
——1siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduced in v3.7.0-beta.1). The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and getHostByName functions that were removed elsewhere for CVE-2024-55660. A local, unauthenticated attacker (the kernel binds to 127.0.0.1 by default with no per-UID access control) can inject a malicious Template calculation formula to read environment variables belonging to the account running siyuan — including from a separate, unprivileged OS account — and to perform DNS lookups from the server's network position.6dCVE-2024-0051—3.1%
——1——CVE-2026-706315.5 MED3.1%
——1FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.12hCVE-2026-40851—3.1%
——1——CVE-2024-0038—3.1%
——1——CVE-2026-612535.4 MED3.1%
——1Vulnerability in the Oracle HRMS (Japanese) product of Oracle E-Business Suite (component: Oracle Payroll Japanese). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle HRMS (Japanese). Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle HRMS (Japanese) accessible data as well as unauthorized read access to a subset of Oracle HRMS (Japanese) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).39dCVE-2024-23511—3.1%
——1——CVE-2022-49798—3.1%
——1——CVE-2020-0263—3.1%
——1——CVE-2026-363885.4 MED3.1%
——1A Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4.0 in the /hospital/hms/edit-profile.php page. This flaw allows an authenticated attacker (patient) to inject a malicious script payload into the User Name parameter, which is stored in the application and later rendered in the doctor s interface.59dCVE-2025-54174—3.1%
——1——CVE-2026-0658—3.1%
——1——CVE-2026-397086.5 MED3.1%
——1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uicore UiCore Elements uicore-elements allows Stored XSS.This issue affects UiCore Elements: from n/a through <= 1.3.14.39dCVE-2022-20074—3.1%
——1——CVE-2022-20542—3.1%
——1——CVE-2026-712755.4 MED3.1%
——1OpenBK7231T's http_fn_ota_exec() (src/httpserver/http_fns.c) reflects the `host` query parameter directly into an HTML response via hprintf255(request, "<h3>OTA requested for %s!</h3>", tmpA) with no HTML encoding, allowing a crafted URL such as /ota_exec?host=<script>alert(1)</script> to execute JavaScript in an authenticated admin's browser when they click a malicious link.6dCVE-2025-33013—3.1%
——1——CVE-2024-0021—3.1%
——1——CVE-2026-43785.4 MED3.1%
——1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Stored XSS.
This issue affects E-Commerce Pack: from 4.5.001 through 28082026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.2dCVE-2025-68925—3.1%
——1——CVE-2026-647955.4 MED3.1%
——1Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers.37dCVE-2025-49158—3.1%
——1——CVE-2026-32448—3.1%
——1——CVE-2026-313135.4 MED3.1%
——1An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Content field.59dCVE-2020-10840—3.1%
——1——CVE-2026-12463—3.1%
——1——CVE-2020-8940—3.1%
——1——CVE-2026-3532—3.1%
——1——CVE-2025-12696—3.1%
——1——CVE-2020-8942—3.1%
——1——CVE-2020-0485—3.1%
——1——CVE-2025-61977—3.1%
——1——CVE-2026-81665.4 MED3.1%
——1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allows Stored XSS.
This issue affects e-Logo Purchasing Portal: before 1.52.6d