Vulnerabilidades explotables hoy
367,284en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,685
Nuevos KEV · 24H0
Exploit Today ≥ 701,629
Distribución · última ventana
- Crítico2,295
- Alto9,354
- Medio5,355
- Bajo528
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-20989—1.4%
——0——CVE-2022-20382—1.4%
——0——CVE-2023-24850—1.4%
——0——CVE-2022-20205—1.4%
——0——CVE-2023-28544—1.4%
——0——CVE-2021-1018—1.4%
——0——CVE-2023-28573—1.4%
——0——CVE-2026-20767—1.4%
——0——CVE-2026-714306.2 MED1.4%
——0node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string length, the unchecked ToLocalChecked call causes a fatal, uncatchable process abort instead of a catchable exception. This issue is fixed in version 1.25.1.24dCVE-2023-43516—1.4%
——0——CVE-2025-36133—1.4%
——0——CVE-2022-20544—1.4%
——0——CVE-2023-20772—1.4%
——0——CVE-2025-9912—1.4%
——0——CVE-2023-33117—1.4%
——0——CVE-2026-02354.7 MED1.4%
——0A race condition vulnerability in Palo Alto Networks Prisma® Browser enables a locally authenticated non-admin user to bypass certain access and data control policies.48dCVE-2021-39739—1.4%
——0——CVE-2024-51519—1.4%
——0——CVE-2021-1031—1.4%
——0——CVE-2022-22271—1.4%
——0——CVE-2025-31645—1.4%
——0——CVE-2021-0988—1.4%
——0——CVE-2026-425587.6 ALT1.4%
——0Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain consisting of Stored XSS and Iframe Sandbox escape in the Xibo CMS allows users with DataSet permissions to use the Data Connector functionality to craft messages which escape the sandbox and facilitate XSS. Exploitation of the vulnerability is possible on behalf of an authorized user who has both of the following privileges, which are not granted to non-admins as standard: Include "Add DataSet" button to allow for additional DataSets to be created independently to Layouts Users should upgrade to version 4.4.2 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust.40dCVE-2023-21662—1.4%
——0——CVE-2026-197705.3 MED1.4%
——0A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.17dCVE-2022-20240—1.4%
——0——CVE-2026-88637.8 ALT1.4%
——0Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker with administrative privileges or the ability to modify the boot process could use one of the vulnerable shim bootloaders to bypass Secure Boot protections and execute arbitrary code before the operating system loads. Specific UEFI DBX update is required to block these vulnerable boot loaders.40dCVE-2025-59485—1.4%
——0——CVE-2021-39651—1.4%
——0——CVE-2024-5558—1.4%
——0——CVE-2026-35250—1.4%
——0——CVE-2024-21475—1.4%
——0——CVE-2026-32303—1.4%
——0——CVE-2023-28567—1.4%
——0——CVE-2021-1032—1.4%
——0——CVE-2024-23378—1.4%
——0——CVE-2021-1015—1.4%
——0——CVE-2023-21664—1.4%
——0——CVE-2025-38567—1.4%
——0——CVE-2023-28559—1.4%
——0——