Vulnerabilidades explotables hoy
367,284en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,685
Nuevos KEV · 24H0
Exploit Today ≥ 701,629
Distribución · última ventana
- Crítico2,274
- Alto9,334
- Medio5,332
- Bajo522
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2022-25332—1.1%
——0——CVE-2024-27212—1.1%
——0——CVE-2021-1011—1.1%
——0——CVE-2026-169806.3 MED1.1%
——0IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper validation of symbolic links.7dCVE-2020-11262—1.1%
——0——CVE-2022-20146—1.1%
——0——CVE-2026-27004—1.1%
——0——CVE-2025-4295—1.1%
——0——CVE-2025-14764—1.1%
——0——CVE-2021-39751—1.1%
——0——CVE-2017-20040—1.1%
——0——CVE-2021-1025—1.1%
——0——CVE-2026-4667—1.1%
——0——CVE-2026-138498.6 ALT1.1%
——0Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)61dCVE-2021-39748—1.1%
——0——CVE-2025-69875—1.1%
——0——CVE-2024-23696—1.1%
——0——CVE-2026-35360—1.1%
——0——CVE-2022-36850—1.1%
——0——CVE-2026-625113.0 BAJ1.1%
——0Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Hyperion Infrastructure Technology executes to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Infrastructure Technology accessible data as well as unauthorized read access to a subset of Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 3.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N).5dCVE-2020-0474—1.1%
——0——CVE-2026-3776—1.1%
——0——CVE-2026-179666.2 MED1.1%
——0Inappropriate implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)28dCVE-2021-0985—1.1%
——0——CVE-2021-39750—1.1%
——0——CVE-2026-537364.3 MED1.1%
——0Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate_post action handler that lacks nonce verification. Attackers can trick an authenticated user into visiting a crafted link that duplicates any post regardless of post type.40dCVE-2026-27646—1.1%
——0——CVE-2025-363646.2 MED1.1%
——0IBM DevOps Plan 3.0.0 through 3.0.5 allows web page cache to be stored locally which can be read by another user on the system.35dCVE-2026-5937—1.1%
——0——CVE-2023-53581—1.1%
——0——CVE-2024-43081—1.1%
——0——CVE-2021-0320—1.1%
——0——CVE-2026-174335.3 MED1.1%
——0A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulation results in improper authorization. The attack needs to be approached locally. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.35dCVE-2026-502433.7 BAJ1.1%
——0In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can instead rewrite a BOGUS A/AAAA answer to point to an operator's configured IP. If the validator finds an expired or otherwise invalid RRSIG on an answer whose A record falls within a 'response-ip'/RPZ configuration, the answer is still rewritten and given a hard coded security level of INSECURE. This results in the client receiving an INSECURE NOERROR reply rewritten by the operator's configured IP. A malicious actor can exploit the possible poisonous effect by spoofing a BOGUS A/AAAA answer that falls inside the operator's configured subnet rewrites. Such DNSSEC protected answers are then insecurely redirected to the operator's configured target.38dCVE-2024-31324—1.1%
——0——CVE-2022-20260—1.1%
——0——CVE-2021-39734—1.1%
——0——CVE-2026-44636—1.1%
——0——CVE-2026-470904.6 MED1.1%
——0Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd and branchUrl values without stripping control characters or encoding embedded values, allowing attackers to inject arbitrary ANSI codes into terminal sessions. Attackers can embed ESC+backslash sequences in the current working directory or branch URL to execute malicious ANSI codes including text color changes, forged prompts, and OSC 52 clipboard writes, or trigger outbound HTTP requests to attacker-controlled remotes when hyperlinks are clicked.48dCVE-2025-48623—1.1%
——0——