Vulnerabilidades explotables hoy
367,134en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,685
Nuevos KEV · 24H0
Exploit Today ≥ 701,629
Distribución · última ventana
- Crítico2,255
- Alto9,255
- Medio5,260
- Bajo507
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2023-52349—0.3%
——0——CVE-2023-32871—0.3%
——0——CVE-2026-190794.4 MED0.3%
——0A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files. This could undermine SELinux mandatory access control protections on critical files such as /etc/shadow.10dCVE-2026-22614—0.3%
——0——CVE-2022-44422—0.3%
——0——CVE-2022-39883—0.3%
——0——CVE-2026-189094.7 MED0.3%
——0A stack-based buffer overflow vulnerability exists in ELAN Microelectronics Corp. ELAN Smart-Pad on Windows (ETD.sys and ETDSMBus.sys). During Intel SMBus recovery, ETDSMBus.sys does not enforce an upper-bound check on the hardware-derived report count, allowing an out-of-range value to be forwarded to ETD.sys where it is used as a loop counter for a stack buffer copy without destination size validation. A local attacker with standard user privileges can trigger a kernel bugcheck (BSOD 0xF7 DRIVER_OVERRAN_STACK_BUFFER), resulting in denial of service. This issue affects ELAN Smart-Pad through ETD24.21.52.3.25dCVE-2022-47323—0.3%
——0——CVE-2022-48445—0.3%
——0——CVE-2026-30785—0.3%
——0——CVE-2022-48446—0.3%
——0——CVE-2022-44437—0.3%
——0——CVE-2022-44436—0.3%
——0——CVE-2022-20376—0.3%
——0——CVE-2025-36900—0.3%
——0——CVE-2023-21142—0.3%
——0——CVE-2025-20782—0.3%
——0——CVE-2023-21321—0.3%
——0——CVE-2024-34743—0.3%
——0——CVE-2025-20770—0.3%
——0——CVE-2024-31327—0.3%
——0——CVE-2025-20780—0.3%
——0——CVE-2023-21346—0.3%
——0——CVE-2025-20807—0.3%
——0——CVE-2026-97286.4 MED0.3%
——0The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mbox_msg * pointer to z_impl_mbox_send() and the underlying driver. Between the access check and the driver's use of msg->data, the validated pointer could be replaced, leaving a time-of-check/time-of-use window.
On a system built with CONFIG_USERSPACE, any unprivileged userspace thread may invoke the mbox_send() system call. A second thread sharing the caller's address space can race to overwrite msg->data with a supervisor (kernel) address after the verifier's bounds check has passed but before the driver dereferences it. The driver then reads from the attacker-chosen address in supervisor context (for example memcpy(&data32, msg->data, msg->size) in the NXP mailbox driver, whose bytes are subsequently emitted to the peer mailbox endpoint).
The impact is a userspace-to-supervisor access-control bypass: disclosure of kernel memory contents (high confidentiality impact), or, for an invalid/unmapped target address, a faulting kernel read causing denial of service. The fix snapshots the entire struct mbox_msg into a kernel-stack copy with k_usermode_from_copy() and validates and forwards that immutable copy, closing the race.6dCVE-2026-4541—0.3%
——0——CVE-2024-20092—0.3%
——0——CVE-2024-13454—0.3%
——0——CVE-2025-48538—0.3%
——0——CVE-2023-20771—0.2%
——0——CVE-2025-26442—0.2%
——0——CVE-2023-33917—0.2%
——0——CVE-2023-48352—0.2%
——0——CVE-2024-36334—0.2%
——0——CVE-2023-48351—0.2%
——0——CVE-2024-29785—0.2%
——0——CVE-2024-39429—0.2%
——0——CVE-2022-47354—0.2%
——0——CVE-2023-40652—0.2%
——0——CVE-2023-48343—0.2%
——0——