Vulnerabilidades explotables hoy
367,284en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,685
Nuevos KEV · 24H0
Exploit Today ≥ 701,629
Distribución · última ventana
- Crítico2,295
- Alto9,354
- Medio5,355
- Bajo528
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-465215.5 MED1.5%
——0ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder an out of bounds write can occur due to a missing check. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.40dCVE-2026-207096.6 MED1.5%
——0Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron(R) Processor J Series, Intel(R) Celeron(R) Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via physical access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.38dCVE-2026-23740—1.5%
——0——CVE-2023-32868—1.5%
——0——CVE-2026-152395.3 MED1.5%
——0The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.5dCVE-2025-66664—1.5%
——0——CVE-2023-22276—1.5%
——0——CVE-2023-43546—1.5%
——0——CVE-2025-13326—1.5%
——0——CVE-2021-25365—1.5%
——0——CVE-2026-22462—1.5%
——0——CVE-2026-29642—1.5%
——0——CVE-2026-712124.4 MED1.5%
——0xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase.5dCVE-2023-32869—1.5%
——0——CVE-2023-32866—1.5%
——0——CVE-2026-28889—1.5%
——0——CVE-2022-42767—1.5%
——0——CVE-2025-58481—1.5%
——0——CVE-2026-16926.1 MED1.5%
——0A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to lure a successfully authenticated user to a malicious website.
This vulnerability only affects the following two endpoints: GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect.53dCVE-2024-51993—1.5%
——0——CVE-2026-24923—1.5%
——0——CVE-2026-759006.1 MED1.5%
——0An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.10dCVE-2025-21002—1.5%
——0——CVE-2025-64429—1.5%
——0——CVE-2026-44310—1.5%
——0——CVE-2024-20139—1.5%
——0——CVE-2021-39776—1.5%
——0——CVE-2024-0042—1.5%
——0——CVE-2026-45905—1.5%
——0——CVE-2024-34726—1.5%
——0——CVE-2022-39913—1.5%
——0——CVE-2024-29955—1.5%
——0——CVE-2022-40534—1.5%
——0——CVE-2026-393492.7 BAJ1.5%
——0OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensitive fields with AES in ECB mode, which preserves block-aligned plaintext patterns in ciphertext and enables pattern disclosure against stored data. This vulnerability is fixed in 5.8.1.38dCVE-2023-43531—1.5%
——0——CVE-2021-25510—1.5%
——0——CVE-2023-43540—1.5%
——0——CVE-2023-43532—1.5%
——0——CVE-2023-0006—1.5%
——0——CVE-2024-20280—1.5%
——0——