Vulnerabilidades explotables hoy
367,284en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,685
Nuevos KEV · 24H0
Exploit Today ≥ 701,629
Distribución · última ventana
- Crítico2,274
- Alto9,334
- Medio5,332
- Bajo522
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-42476—1.2%
——0——CVE-2026-2026—1.2%
——0——CVE-2024-7295—1.2%
——0——CVE-2022-20372—1.2%
——0——CVE-2026-6389—1.2%
——0——CVE-2024-45543—1.2%
——0——CVE-2021-25363—1.2%
——0——CVE-2022-21758—1.2%
——0——CVE-2026-25122—1.2%
——0——CVE-2022-21785—1.2%
——0——CVE-2021-0706—1.2%
——0——CVE-2026-26070—1.2%
——0——CVE-2026-446097.3 ALT1.2%
——0Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.40dCVE-2026-41425—1.2%
——0——CVE-2026-114593.3 BAJ1.2%
——0A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. Impacted is an unknown function in the library saappctl.sys of the component IOCTL Handler. The manipulation leads to information disclosure. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used.40dCVE-2024-40575—1.2%
——0——CVE-2025-27700—1.2%
——0——CVE-2026-169467.8 ALT1.2%
——0IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a heap buffer overflow.7dCVE-2026-784174.3 MED1.2%
——0Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication.3dCVE-2024-9592—1.2%
——0——CVE-2026-420617.3 ALT1.2%
——0Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.40dCVE-2023-21123—1.2%
——0——CVE-2022-25817—1.2%
——0——CVE-2026-108273.5 BAJ1.2%
——0The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. The injected styles are served to anonymous visitors of those pages and can force external resource loads, deface/redress the page, or exfiltrate data via CSS attribute selectors. JavaScript execution is not possible at this role (the script-tag breakout is removed by KSES), so the impact is limited to CSS injection.5dCVE-2025-48512—1.2%
——0——CVE-2024-20058—1.2%
——0——CVE-2025-156216.0 MED1.2%
——0Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication10dCVE-2024-40658—1.2%
——0——CVE-2018-9389—1.2%
——0——CVE-2025-68957—1.2%
——0——CVE-2026-272215.5 MED1.2%
——0Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to spoof the identity of a signer. Exploitation of this issue requires user interaction.4dCVE-2026-187392.5 BAJ1.2%
——0A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.4hCVE-2026-107832.5 BAJ1.2%
——0A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache Key Handler. Performing a manipulation results in use of weak hash. The attack must be initiated from a local position. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The patch is named 13394. To fix this issue, it is recommended to deploy a patch.40dCVE-2021-25359—1.2%
——0——CVE-2024-45540—1.2%
——0——CVE-2022-20152—1.2%
——0——CVE-2026-790865.1 MED1.2%
——0Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)3dCVE-2022-21787—1.2%
——0——CVE-2023-21115—1.2%
——0——CVE-2025-54547—1.2%
——0——