Vulnerabilidades explotables hoy
367,165en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,685
Nuevos KEV · 24H0
Exploit Today ≥ 701,629
Distribución · última ventana
- Crítico2,263
- Alto9,269
- Medio5,274
- Bajo508
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-179843.3 BAJ0.6%
——0Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)28dCVE-2023-21248—0.6%
——0——CVE-2022-38675—0.6%
——0——CVE-2023-21152—0.6%
——0——CVE-2023-21225—0.6%
——0——CVE-2023-21168—0.6%
——0——CVE-2022-48439—0.6%
——0——CVE-2024-45273—0.6%
——0——CVE-2026-174384.4 MED0.6%
——0IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege management.12dCVE-2021-0529—0.6%
——0——CVE-2025-48596—0.6%
——0——CVE-2023-20782—0.5%
——0——CVE-2026-585627.3 ALT0.6%
——0Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.10dCVE-2026-32803—0.6%
——0——CVE-2022-47351—0.6%
——0——CVE-2025-14575—0.6%
——0An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.33dCVE-2022-20230—0.6%
——0——CVE-2023-23588—0.6%
——0——CVE-2026-151745.5 MED0.6%
——0Catapult DCT2000 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service53dCVE-2025-710795.5 MED0.6%
——0In the Linux kernel, the following vulnerability has been resolved:
net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
A deadlock can occur between nfc_unregister_device() and rfkill_fop_write()
due to lock ordering inversion between device_lock and rfkill_global_mutex.
The problematic lock order is:
Thread A (rfkill_fop_write):
rfkill_fop_write()
mutex_lock(&rfkill_global_mutex)
rfkill_set_block()
nfc_rfkill_set_block()
nfc_dev_down()
device_lock(&dev->dev) <- waits for device_lock
Thread B (nfc_unregister_device):
nfc_unregister_device()
device_lock(&dev->dev)
rfkill_unregister()
mutex_lock(&rfkill_global_mutex) <- waits for rfkill_global_mutex
This creates a classic ABBA deadlock scenario.
Fix this by moving rfkill_unregister() and rfkill_destroy() outside the
device_lock critical section. Store the rfkill pointer in a local variable
before releasing the lock, then call rfkill_unregister() after releasing
device_lock.
This change is safe because rfkill_fop_write() holds rfkill_global_mutex
while calling the rfkill callbacks, and rfkill_unregister() also acquires
rfkill_global_mutex before cleanup. Therefore, rfkill_unregister() will
wait for any ongoing callback to complete before proceeding, and
device_del() is only called after rfkill_unregister() returns, preventing
any use-after-free.
The similar lock ordering in nfc_register_device() (device_lock ->
rfkill_global_mutex via rfkill_register) is safe because during
registration the device is not yet in rfkill_list, so no concurrent
rfkill operations can occur on this device.48dCVE-2023-21083—0.6%
——0——CVE-2024-25986—0.6%
——0——CVE-2025-47398—0.6%
——0——CVE-2025-47366—0.6%
——0——CVE-2023-21090—0.6%
——0——CVE-2026-47330—0.6%
——0——CVE-2026-466924.1 MED0.6%
——0ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-write in the server process. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.39dCVE-2024-43108—0.6%
——0——CVE-2023-20698—0.5%
——0——CVE-2026-20993—0.6%
——0——CVE-2025-12683—0.6%
——0——CVE-2022-47347—0.6%
——0——CVE-2025-47399—0.6%
——0——CVE-2023-20697—0.5%
——0——CVE-2026-345275.3 MED0.6%
——0Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, SbieIniServer::HashPassword converts a SHA-1 digest to hexadecimal incorrectly. The high nibble of each byte is shifted right by 8 instead of 4, which always produces zero for an 8-bit value. As a result, the stored EditPassword hash only preserves the low nibble of each digest byte, reducing the effective entropy from 160 bits to 80 bits. This is layered on top of an unsalted SHA-1 scheme. The reduced entropy makes leaked or backed-up password hashes materially easier to brute-force.
This issue has been fixed in version 1.17.3.38dCVE-2026-28716—0.6%
——0——CVE-2022-33728—0.6%
——0——CVE-2025-20705—0.6%
——0——CVE-2026-348226.4 MED0.6%
——0Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the new_cert_name parameter to /manage/ca/certificate/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.38dCVE-2023-20995—0.6%
——0——