Vulnerabilidades explotables hoy
406,871en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,766
Nuevos KEV · 24H0
Exploit Today ≥ 701,698
Distribución · última ventana
- Crítico5,596
- Alto21,811
- Medio20,336
- Bajo2,115
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2025-63014—1.8%
——1——CVE-2025-62084—1.8%
——1——CVE-2026-4009—1.8%
——1——CVE-2019-9375—1.8%
——1——CVE-2022-20038—1.8%
——1——CVE-2026-72806.7 MED1.8%
——1AVACAST developed by eMPIA Technology has a Unquoted Service Path vulnerability, allowing privileged local attackers to place a malicious executable file in a specific directory, resulting in arbitrary code execution with system privileges when the AVACAST service starts.8dCVE-2023-33114—1.8%
——1——CVE-2022-20018—1.8%
——1——CVE-2025-675904.3 MED1.8%
——1Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Ultimate FAQ ultimate-faqs allows Cross Site Request Forgery.This issue affects Ultimate FAQ: from n/a through <= 2.4.3.26dCVE-2026-1040305.5 MED1.8%
——1A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash and disrupting authentication services.6dCVE-2026-1161946.8 MED1.8%
——1Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.5dCVE-2023-33094—1.8%
——1——CVE-2026-107738—1.8%
——1SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ() narrows file-controlled unsigned string offsets from /#WINDOWS and /#IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /#STRINGS buffer, causing deterministic application termination. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.20dCVE-2022-35720—1.8%
——1——CVE-2025-62148—1.8%
——1——CVE-2026-1127015.5 MED1.8%
——1An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data.20hCVE-2026-31702—1.8%
——1——CVE-2026-18503—1.8%
——1Attacker-controlled CSV samples can trigger super-linear
regular-expression work during dialect sniffing and consume significant
CPU when applications pass unbounded input to csv.Sniffer.sniff().11dCVE-2025-675934.3 MED1.8%
——1Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.48.26dCVE-2026-46231—1.8%
——1——CVE-2026-4016—1.8%
——1——CVE-2025-675984.3 MED1.8%
——1Cross-Site Request Forgery (CSRF) vulnerability in PSM Plugins SupportCandy supportcandy allows Cross Site Request Forgery.This issue affects SupportCandy: from n/a through <= 3.4.1.20dCVE-2026-675966.2 MED1.8%
——1CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher that uses a static key to obfuscate the configuration backup file. Attackers can trivially decrypt the Router.cfg backup file to expose web administration and telnet passwords, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN credentials, and SIM identifiers including IMSI and IMEI.11dCVE-2026-43281—1.8%
——1——CVE-2021-0487—1.8%
——1——CVE-2025-621904.3 MED1.8%
——1Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link21dCVE-2026-564096.5 MED1.8%
——1xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.9dCVE-2021-0900—1.8%
——1——CVE-2026-3707—1.8%
——1——CVE-2022-39853—1.8%
——1——CVE-2026-810494.4 MED1.8%
——1Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Support for Integrity Check vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution.48dCVE-2026-107736—1.8%
——1SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-controlled PropertyTagOrientation size through GetPropertyItem() while supplying only a fixed 64-byte buf on the stack. Opening a crafted TIFF with enough EXIF Orientation values can cause attacker-selected bytes to overwrite stack control data, while tested builds terminate through the stack cookie check. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.25dCVE-2024-25024—1.8%
——1——CVE-2026-25014—1.8%
——1——CVE-2024-47157—1.8%
——1——CVE-2025-38506—1.8%
——1——CVE-2026-46220—1.8%
——1——CVE-2026-46228—1.8%
——1——CVE-2021-0677—1.8%
——1——CVE-2021-0676—1.8%
——1——