Vulnerabilidades explotables hoy
367,069en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,685
Nuevos KEV · 24H0
Exploit Today ≥ 701,629
Distribución · última ventana
- Crítico2,242
- Alto9,242
- Medio5,232
- Bajo501
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2024-40652—0.2%
——0——CVE-2023-21362—0.2%
——0——CVE-2026-118122.5 BAJ0.2%
——0The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single file-scope ctx structure that holds the CoAP block context, payload buffer, status code, socket, and a one-element poll-fd array fds[1]. Access to ctx was not serialized, and prepare_fds() wrote ctx.fds[ctx.nfds] and incremented ctx.nfds with no bounds check.
Two independent paths mutate ctx concurrently: the background autohandler running on the system workqueue, and user-triggered operations reached through the updatehub run shell command, direct API calls, or — since the operations are exposed as syscalls — userspace threads. When a second flow enters prepare_fds() while ctx.nfds is already 1, the write lands one element past the array; by struct layout it overlaps the adjacent ctx.sock/ctx.nfds members. More broadly, the unsynchronized sharing lets two flows interleave connection setup and teardown, double-closing a socket descriptor or scribbling the shared buffers.
The result is corruption of the update subsystem's internal state and denial of service of the firmware-update path; the out-of-bounds write is contained within the ctx structure and there is no demonstrated path to memory outside it or to code execution. Triggering requires a local actor able to invoke update operations (or, with CONFIG_USERSPACE, an unprivileged userspace thread) and to win a timing race against the background handler; remote peers cannot control the race timing. The fix serializes the entry points with a mutex and adds a bounds check to prepare_fds().5dCVE-2025-47368—0.2%
——0——CVE-2025-31711—0.2%
——0——CVE-2024-53838—0.2%
——0——CVE-2018-9414—0.2%
——0——CVE-2024-40655—0.2%
——0——CVE-2026-67433—0.2%
——0Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename() and allowed a local user controlling the plugin account to place a symlink that would be followed by sqlite3.connect() during a root-run check.32dCVE-2026-493056.2 MED0.2%
——0Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful exploitation of this vulnerability may affect availability.5dCVE-2022-26451—0.2%
——0——CVE-2023-42646—0.2%
——0——CVE-2024-38487—0.2%
——0——CVE-2025-20744—0.2%
——0——CVE-2026-0117—0.2%
——0——CVE-2025-47352—0.2%
——0——CVE-2024-27210—0.2%
——0——CVE-2025-68965—0.2%
——0——CVE-2026-179937.0 ALT0.2%
——0Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Low)31dCVE-2025-27725—0.2%
——0——CVE-2025-54655—0.2%
——0——CVE-2026-53406—0.2%
——0——CVE-2025-20763—0.2%
——0——CVE-2022-48458—0.2%
——0——CVE-2026-478367.2 ALT0.2%
——0The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks.
Spring Cloud Config 5.0.0 - 5.0.4
Spring Cloud Config 4.3.0 - 4.3.4
Spring Cloud Config 4.0.0 - 4.2.8
Spring Cloud Config 3.1.14 and earlier3dCVE-2024-53837—0.2%
——0——CVE-2022-48455—0.2%
——0——CVE-2025-36522—0.2%
——0——CVE-2026-344905.5 MED0.2%
——0Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data.
This issue affects XAAP Application: before 1.53.21dCVE-2025-48628—0.2%
——0——CVE-2026-641715.5 MED0.2%
——0In the Linux kernel, the following vulnerability has been resolved:
i2c: tegra: fix pm_runtime leak on mutex_lock failure
If tegra_i2c_mutex_lock() fails, the function returns without calling
pm_runtime_put(), leaking the runtime PM reference acquired by the
preceding pm_runtime_get_sync(). This prevents the device from ever
entering runtime suspend.
Add the missing pm_runtime_put() before returning on lock failure.18dCVE-2025-27062—0.2%
——0——CVE-2023-42650—0.2%
——0——CVE-2025-58312—0.2%
——0——CVE-2025-20789—0.2%
——0——CVE-2025-32313—0.2%
——0——CVE-2026-110357.3 ALT0.2%
——0Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation via a crafted XML file. (Chromium security severity: Medium)39dCVE-2023-42640—0.2%
——0——CVE-2023-38443—0.2%
——0——CVE-2024-20120—0.2%
——0——