Vulnerabilidades explotables hoy
367,284en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,685
Nuevos KEV · 24H0
Exploit Today ≥ 701,629
Distribución · última ventana
- Crítico2,295
- Alto9,354
- Medio5,355
- Bajo528
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2025-32327—1.5%
——0——CVE-2026-153845.7 MED1.5%
——0The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and overwrite that attachment's generated intermediate-size image (for example its thumbnail) and mutate its stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library. The action also has no nonce, so it is additionally susceptible to CSRF.5dCVE-2023-32868—1.5%
——0——CVE-2026-152395.3 MED1.5%
——0The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.5dCVE-2023-43546—1.5%
——0——CVE-2025-66664—1.5%
——0——CVE-2026-23740—1.5%
——0——CVE-2022-20208—1.5%
——0——CVE-2025-36613—1.5%
——0——CVE-2024-21468—1.5%
——0——CVE-2024-11957—1.5%
——0——CVE-2026-217706.5 MED1.5%
——0HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.45dCVE-2021-25510—1.5%
——0——CVE-2023-0006—1.5%
——0——CVE-2023-43532—1.5%
——0——CVE-2024-20280—1.5%
——0——CVE-2023-43540—1.5%
——0——CVE-2025-64429—1.5%
——0——CVE-2024-51993—1.5%
——0——CVE-2026-759006.1 MED1.5%
——0An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.10dCVE-2025-58481—1.5%
——0——CVE-2024-20139—1.5%
——0——CVE-2022-42767—1.5%
——0——CVE-2026-24923—1.5%
——0——CVE-2026-44310—1.5%
——0——CVE-2025-21002—1.5%
——0——CVE-2026-16926.1 MED1.5%
——0A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to lure a successfully authenticated user to a malicious website.
This vulnerability only affects the following two endpoints: GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect.53dCVE-2022-33275—1.5%
——0——CVE-2026-207096.6 MED1.5%
——0Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron(R) Processor J Series, Intel(R) Celeron(R) Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via physical access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.38dCVE-2026-465215.5 MED1.5%
——0ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder an out of bounds write can occur due to a missing check. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.40dCVE-2023-21474—1.5%
——0——CVE-2023-33023—1.5%
——0——CVE-2021-0692—1.5%
——0——CVE-2026-73070—1.5%
——0Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserver_accept(), causing descriptors to overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c, which allows a local process that can connect to the server socket to corrupt stack memory or terminate the Vim server. This issue is fixed in version 9.2.0842.20dCVE-2023-32861—1.5%
——0——CVE-2025-68462—1.5%
——0——CVE-2025-6180—1.5%
——0——CVE-2023-23435—1.5%
——0——CVE-2024-21472—1.5%
——0——CVE-2023-0460—1.5%
——0——