Vulnerabilidades explotables hoy
367,284en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,685
Nuevos KEV · 24H0
Exploit Today ≥ 701,629
Distribución · última ventana
- Crítico2,295
- Alto9,354
- Medio5,355
- Bajo528
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2019-9268—1.8%
——1——CVE-2026-302667.8 ALT1.8%
——1Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbitrary code via a crafted file58dCVE-2026-762275.5 MED1.8%
——1Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.7dCVE-2026-74055.5 MED1.8%
——1A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service6dCVE-2021-0677—1.8%
——1——CVE-2026-45963—1.8%
——1——CVE-2026-55530—1.8%
——1——CVE-2023-43527—1.8%
——1——CVE-2026-48066—1.8%
——1——CVE-2025-40770—1.8%
——1——CVE-2023-22667—1.8%
——1——CVE-2022-40532—1.8%
——1——CVE-2022-33232—1.8%
——1——CVE-2021-0900—1.8%
——1——CVE-2025-35968—1.8%
——1——CVE-2025-47370—1.8%
——1——CVE-2021-39798—1.8%
——1——CVE-2026-46032—1.8%
——1——CVE-2026-33850—1.8%
——1——CVE-2021-0611—1.8%
——1——CVE-2021-0610—1.8%
——1——CVE-2026-34534—1.8%
——1——CVE-2026-27754—1.8%
——1——CVE-2021-0528—1.8%
——1——CVE-2026-453803.6 BAJ1.8%
——1bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, a one-byte off-by-one error in SafeOutPathBuilder::restoreSymlink() allows an attacker to craft a .7z archive that, when extracted with bit7z on any non-Windows platform, creates a symlink escaping the intended output directory. Subsequent archive entries extracted through this symlink write arbitrary files outside the extraction directory with the permissions of the extracting process. This issue has been patched in version 4.0.12.40dCVE-2026-139553.3 BAJ1.8%
——1Insufficient validation of untrusted input in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a malicious file. (Chromium security severity: Medium)61dCVE-2025-20696—1.8%
——1——CVE-2022-33276—1.8%
——1——CVE-2021-0666—1.8%
——1——CVE-2021-0902—1.8%
——1——CVE-2022-20079—1.8%
——1——CVE-2026-252899.6 CRÍ1.8%
——1Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.25dCVE-2025-61971—1.8%
——1——CVE-2025-52641—1.8%
——1——CVE-2025-4879—1.8%
——1——CVE-2021-0527—1.8%
——1——CVE-2022-33269—1.8%
——1——CVE-2023-28537—1.8%
——1——CVE-2026-645017.1 ALT1.8%
——1In the Linux kernel, the following vulnerability has been resolved:
iio: adc: ad_sigma_delta: fix CS held asserted and state leaks
In ad_sigma_delta_single_conversion(), set_mode(AD_SD_MODE_IDLE) and
disable_one() were called from the out: block while keep_cs_asserted
was still true. This caused any SPI transfer issued by those callbacks
to carry cs_change=1, leaving CS permanently asserted after the
conversion. Fix by moving both calls into the out_unlock: block, after
keep_cs_asserted is cleared, matching the pattern already used in
ad_sd_calibrate().
In the error path of ad_sd_buffer_postenable(), if an operation fails
after set_mode(AD_SD_MODE_CONTINUOUS) has already succeeded (e.g.
spi_offload_trigger_enable()), the device is left in continuous
conversion mode with CS physically asserted. Additionally,
bus_locked remaining true after spi_bus_unlock() causes subsequent
SPI operations to call spi_sync_locked() without the bus lock actually
held, allowing concurrent SPI access.
Fix the error path by clearing keep_cs_asserted first, then calling
set_mode(AD_SD_MODE_IDLE) to revert the device mode and deassert CS,
then clearing bus_locked before releasing the bus.
For devices that implement neither set_mode nor disable_one (such as
MAX11205, which has no physical CS pin), no SPI transfer is issued
during cleanup and the cs_change flag has no effect on any physical
line.15dCVE-2021-0531—1.8%
——1——