Vulnerabilidades explotables hoy
406,578en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,766
Nuevos KEV · 24H0
Exploit Today ≥ 701,698
Distribución · última ventana
- Crítico5,578
- Alto21,619
- Medio20,219
- Bajo2,099
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2025-612287.8 ALT1.5%
——0An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute arbitrary code via the software update mechanism121dCVE-2026-50568—1.5%
——0——CVE-2024-25023—1.5%
——0——CVE-2022-20192—1.5%
——0——CVE-2022-33296—1.5%
——0——CVE-2025-5941—1.5%
——0——CVE-2026-95673.3 BAJ1.5%
——0A security flaw has been discovered in GPAC up to 2.4.0. Affected is the function MergeFragment of the file src/isomedia/isom_intern.c of the component MP4Box. The manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The patch is identified as 525bf1af642c30af04e4df5345e6d798c0a4d8a1. It is advisable to implement a patch to correct this issue.102dCVE-2025-210574.0 MED1.5%
——0Use of implicit intent for sensitive communication in Samsung Notes prior to version 4.4.30.63 allows local attackers to access shared notes.25dCVE-2026-562885.5 MED1.5%
——0GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive end-of-file newline markers can corrupt internal hunk (single block of changes in diff) data structures, causing the application to pass a NULL pointer to fwrite() during patch processing.
An attacker can trigger this condition with a malicious patch file, causing the utility to crash and resulting in a denial of service.
This issue has been fixed in the commit e6d6a4e021660679d7fc9150f981d4920f7223138dCVE-2023-20797—1.5%
——0——CVE-2026-31713—1.5%
——0——CVE-2026-463145.5 MED1.5%
——0In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Reject empty multisync extension to prevent infinite loop
v3d_get_extensions() walks a userspace-provided singly-linked list of
ioctl extensions without any bound on the chain length. A local user
can craft a self-referential extension (ext->next == &ext) with zero
in_sync_count and out_sync_count, which bypasses the existing duplicate-
extension guard:
if (se->in_sync_count || se->out_sync_count)
return -EINVAL;
The guard never fires because v3d_get_multisync_post_deps() returns
immediately when count is zero, leaving both fields at zero on every
iteration. The result is an infinite loop in kernel context, blocking
the calling thread and pegging a CPU core indefinitely.
Fix this by rejecting a multisync extension where both in_sync_count
and out_sync_count are zero in v3d_get_multisync_submit_deps(). An
empty multisync carries no synchronization information and serves no
useful purpose, so returning -EINVAL for such an extension is the
correct defense against this attack vector.103dCVE-2026-84356.5 MED1.5%
——0Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting.102dCVE-2026-924295.3 MED1.5%
——0The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and cancelling completed orders.18dCVE-2021-0583—1.5%
——0——CVE-2024-43046—1.5%
——0——CVE-2021-1016—1.5%
——0——CVE-2022-33263—1.5%
——0——CVE-2026-493056.2 MED1.5%
——0Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful exploitation of this vulnerability may affect availability.9dCVE-2026-945937.8 ALT1.5%
——0Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access to the server operating system is available.27dCVE-2022-20198—1.5%
——0——CVE-2022-33267—1.5%
——0——CVE-2021-39752—1.5%
——0——CVE-2018-25274—1.5%
——0——CVE-2026-1033595.3 MED1.5%
——0The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from an empty secret that anyone can compute, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid and completed.5dCVE-2025-66521—1.5%
——0——CVE-2023-21633—1.5%
——0——CVE-2021-1030—1.5%
——0——CVE-2026-419876.2 MED1.5%
——0Permission control vulnerability in the app management module.
Impact: Successful exploitation of this vulnerability may affect availability.54dCVE-2023-21650—1.5%
——0——CVE-2022-33230—1.5%
——0——CVE-2023-46294—1.5%
——0——CVE-2022-33240—1.5%
——0——CVE-2022-20176—1.5%
——0——CVE-2023-20775—1.5%
——0——CVE-2023-21644—1.5%
——0——CVE-2021-0584—1.5%
——0——CVE-2026-45353—1.5%
——0——CVE-2026-81426.5 MED1.5%
——0VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates.8dCVE-2025-27708—1.5%
——0——