Vulnerabilidades explotables hoy
367,284en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,685
Nuevos KEV · 24H0
Exploit Today ≥ 701,629
Distribución · última ventana
- Crítico2,295
- Alto9,354
- Medio5,355
- Bajo528
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-6192—1.5%
——0——CVE-2025-67646—1.5%
——0——CVE-2026-23189—1.5%
——0——CVE-2026-204816.0 MED1.5%
——0In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10965373; Issue ID: MSV-6935.12dCVE-2025-49343—1.5%
——0——CVE-2026-185813.3 BAJ1.5%
——0A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input {{9|9|{ can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.19dCVE-2026-43463—1.5%
——0——CVE-2021-39778—1.5%
——0——CVE-2025-2183—1.5%
——0——CVE-2026-0293—1.5%
——0A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files.
The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.13dCVE-2025-49354—1.5%
——0——CVE-2026-43485—1.5%
——0——CVE-2025-59137—1.5%
——0——CVE-2026-0493—1.5%
——0——CVE-2026-23384—1.5%
——0——CVE-2026-23104—1.5%
——0——CVE-2026-28686—1.5%
——0——CVE-2026-113123.3 BAJ1.5%
——0A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.40dCVE-2025-27904—1.5%
——0——CVE-2026-44972—1.5%
——0——CVE-2026-529055.5 MED1.5%
——0In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: disallow non-power of two min_region_sz on damon_start()
Commit d8f867fa0825 ("mm/damon: add damon_ctx->min_sz_region") introduced
a bug that allows unaligned DAMON region address ranges. Commit
c80f46ac228b ("mm/damon/core: disallow non-power of two min_region_sz")
fixed it, but only for damon_commit_ctx() use case. Still, DAMON sysfs
interface can emit non-power of two min_region_sz via damon_start(). Fix
the path by adding the is_power_of_2() check on damon_start().
The issue was discovered by sashiko [1].40dCVE-2026-43337—1.5%
——0——CVE-2025-49456—1.5%
——0——CVE-2026-188523.3 BAJ1.5%
——0A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This impacts the function SplitTokens/ShuntingYard of the file engine/query/expr/expr.cpp of the component Filter Parser. Such manipulation leads to improper check for unusual conditions. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.19dCVE-2025-68885—1.5%
——0——CVE-2022-33861—1.5%
——0——CVE-2026-6830—1.5%
——0——CVE-2025-49342—1.5%
——0——CVE-2026-599137.8 ALT1.5%
——0Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Critical Function vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.26dCVE-2026-102983.3 BAJ1.5%
——0A security flaw has been discovered in ggml-org whisper.cpp up to 1.8.2. This vulnerability affects the function whisper_model_load of the file ggml/src/ggml.c. The manipulation results in null pointer dereference. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.40dCVE-2026-43346—1.5%
——0——CVE-2025-43339—1.5%
——0——CVE-2026-0106—1.5%
——0——CVE-2025-49346—1.5%
——0——CVE-2025-64368—1.5%
——0——CVE-2026-818934.7 MED1.5%
——0A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image.
Affected version >= 2.26.43dCVE-2026-143305.5 MED1.5%
——0Multiple unbounded alloca() calls in the PulseAudio protocol server.18hCVE-2026-24432—1.5%
——0——CVE-2026-707585.3 MED1.5%
——0Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Reporting executes to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Reporting accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N).6dCVE-2026-799395.8 MED1.5%
——0Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection.3d