Vulnerabilidades explotables hoy
406,443en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,766
Nuevos KEV · 24H0
Exploit Today ≥ 701,698
Distribución · última ventana
- Crítico5,566
- Alto21,522
- Medio20,094
- Bajo2,095
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-409295.4 MED1.4%
——0WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/commentDelete.json.php` is a state-mutating JSON endpoint that deletes comments but performs no CSRF validation. It does not call `forbidIfIsUntrustedRequest()`, does not verify a CSRF/global token, and does not check `Origin`/`Referer`. Because AVideo intentionally sets `session.cookie_samesite=None` (to support cross-origin embed players), a cross-site request from any attacker-controlled page automatically carries the victim's `PHPSESSID`. Any authenticated victim who has authority to delete one or more comments (site moderators, video owners, and comment authors) can be tricked into deleting comments en masse simply by visiting an attacker page. Commit 184f36b1896f3364f864f17c1acca3dd8df3af27 contains a fix.7dCVE-2023-22382—1.4%
——0——CVE-2022-40523—1.4%
——0——CVE-2026-888385.5 MED1.4%
——0A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.18dCVE-2022-20089—1.4%
——0——CVE-2024-11604—1.4%
——0——CVE-2026-1085053.3 BAJ1.4%
——0ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information.20dCVE-2024-51525—1.4%
——0——CVE-2021-39718—1.4%
——0——CVE-2026-3774—1.4%
——0——CVE-2026-21127—1.4%
——0Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.17dCVE-2022-20212—1.4%
——0——CVE-2024-42034—1.4%
——0——CVE-2026-449725.0 MED1.4%
——0GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject ANSI or OSC escape sequences into analyst terminals or CI logs.7dCVE-2026-1024744.0 MED1.4%
——0A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation.34dCVE-2022-20356—1.4%
——0——CVE-2026-47580—1.4%
——0——CVE-2026-2817—1.4%
——0——CVE-2025-54606—1.4%
——0——CVE-2022-30723—1.4%
——0——CVE-2025-27577—1.4%
——0——CVE-2026-77393.3 BAJ1.4%
——0A weakness has been identified in justdan96 tsMuxer up to 2.7.0. This vulnerability affects the function HevcVpsUnit::setFPS of the file /AFLplusplus/tsMuxer_prev/tsMuxer/hevc.cpp. This manipulation of the argument track_id causes denial of service. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.7dCVE-2026-180587.5 ALT1.4%
——0The mobile Smart Connect dashboard UI was subject to manipulation
by 3rd party apps. When paired with a phishing attack, this manipulation could
result in escalated privileges of an attacker within the system.54dCVE-2026-43174—1.4%
——0——CVE-2026-606014.4 MED1.4%
——0Vulnerability in the PeopleSoft Enterprise FIN Common Objects product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Common Objects executes to compromise PeopleSoft Enterprise FIN Common Objects. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Common Objects accessible data. CVSS 3.1 Base Score 4.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N).9dCVE-2021-39778—1.4%
——0——CVE-2024-45563—1.4%
——0——CVE-2024-45583—1.4%
——0——CVE-2026-43192—1.4%
——0——CVE-2024-49830—1.4%
——0——CVE-2023-53166—1.4%
——0——CVE-2026-88781—1.4%
——0Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory address via an I/O command, leading to subsequent system information being tampered with or causing a system crash.
Refer to the 'Security Update for Multiple ASUS Motherboards' section on the ASUS Security Advisory for more information.6dCVE-2026-168903.6 BAJ1.4%
——0IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information or cause a denial of service due to an integer overflow.7dCVE-2023-35675—1.4%
——0——CVE-2026-798257.1 ALT1.4%
——0A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.18dCVE-2026-531145.5 MED1.4%
——0In the Linux kernel, the following vulnerability has been resolved:
perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler
Calling perf_allow_kernel() from the NMI context is unsafe and could be
fatal. Capture the permission at event-initialization time by storing it
in event->hw.flags, and have the NMI handler rely on that cached flag
instead of making the call directly.102dCVE-2026-46153—1.4%
——0——CVE-2024-45540—1.4%
——0——CVE-2026-43349—1.4%
——0——CVE-2026-43474—1.4%
——0——