Vulnerabilidades explotables hoy
367,284en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,687
Nuevos KEV · 24H0
Exploit Today ≥ 701,629
Distribución · última ventana
- Crítico2,311
- Alto9,414
- Medio5,381
- Bajo529
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-45952—2.6%
——1——CVE-2026-453289.3 CRÍ2.6%
——1ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c that bridge calls from the user application (i.e. the REE) to TEE-protected hardware peripherals (AES, SHA, ECC, HMAC, SPI, MMU, WDT) and to the security feature like attestation, OTA updates, secure storage. This issue has been patched in versions 5.5.5 and 6.0.1.40dCVE-2024-34586—2.6%
——1——CVE-2026-23076—2.6%
——1——CVE-2025-46327—2.6%
——1——CVE-2026-709027.1 ALT2.6%
——1Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Data Relationship Management executes to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).8dCVE-2024-47476—2.6%
——1——CVE-2024-39673—2.6%
——1——CVE-2025-21049—2.6%
——1——CVE-2024-10254—2.6%
——1——CVE-2026-42890—2.6%
——1——CVE-2026-45981—2.6%
——1——CVE-2023-40091—2.6%
——1——CVE-2026-1852—2.6%
——1——CVE-2025-5345—2.6%
——1——CVE-2025-46306—2.6%
——1——CVE-2026-41965—2.6%
——1——CVE-2026-67887.8 ALT2.6%
——1Uncontrolled Search Path Element vulnerability in WatchGuard Agent on Windows allows Using Malicious Files.22dCVE-2024-55582—2.6%
——1——CVE-2025-36573—2.6%
——1——CVE-2025-21076—2.6%
——1——CVE-2023-41090—2.6%
——1——CVE-2021-0395—2.6%
——1——CVE-2026-641015.5 MED2.6%
——1In the Linux kernel, the following vulnerability has been resolved:
fwctl: pds: Validate RPC input size before parsing
The fwctl core allocates the device-specific RPC input buffer with
fwctl_rpc.in_len and passes that buffer to the driver callback.
pdsfc_fw_rpc() casts the buffer to struct fwctl_rpc_pds and then calls
pdsfc_validate_rpc(), which reads fields from that structure before
checking that the input buffer is large enough to contain it. A short
in_len can make pds_fwctl read beyond the allocation.
Reject pds RPC buffers that are smaller than struct fwctl_rpc_pds before
parsing any pds-specific fields.21dCVE-2026-316807.8 ALT2.6%
——1In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: flowlabel: defer exclusive option free until RCU teardown
`ip6fl_seq_show()` walks the global flowlabel hash under the seq-file
RCU read-side lock and prints `fl->opt->opt_nflen` when an option block
is present.
Exclusive flowlabels currently free `fl->opt` as soon as `fl->users`
drops to zero in `fl_release()`. However, the surrounding
`struct ip6_flowlabel` remains visible in the global hash table until
later garbage collection removes it and `fl_free_rcu()` finally tears it
down.
A concurrent `/proc/net/ip6_flowlabel` reader can therefore race that
early `kfree()` and dereference freed option state, triggering a crash
in `ip6fl_seq_show()`.
Fix this by keeping `fl->opt` alive until `fl_free_rcu()`. That matches
the lifetime already required for the enclosing flowlabel while readers
can still reach it under RCU.49dCVE-2026-151153.3 BAJ2.6%
——1Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.115 allowed a local attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)54dCVE-2025-30756—2.6%
——1——CVE-2025-6017—2.6%
——1——CVE-2020-10846—2.6%
——1——CVE-2026-23069—2.6%
——1——CVE-2023-25189—2.6%
——1——CVE-2025-71285—2.6%
——1——CVE-2026-1086—2.6%
——1——CVE-2024-8011—2.6%
——1——CVE-2025-2503—2.6%
——1——CVE-2025-9711—2.6%
——1——CVE-2025-0034—2.6%
——1——CVE-2026-48693—2.6%
——1——CVE-2025-4960—2.6%
——1——CVE-2026-585504.0 MED2.6%
——1Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.48d