Vulnerabilidades explotables hoy
406,286en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,766
Nuevos KEV · 24H0
Exploit Today ≥ 701,698
Distribución · última ventana
- Crítico5,560
- Alto21,585
- Medio20,085
- Bajo2,090
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2021-25500—1.0%
——0——CVE-2026-735976.5 MED1.0%
——0Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Launch of phishing attacks, and Protection mechanism bypass.17dCVE-2016-20074—1.0%
——0——CVE-2024-23715—1.0%
——0——CVE-2024-38413—1.0%
——0——CVE-2022-50436—1.0%
——0——CVE-2026-89166.1 MED1.0%
——0Out-of-bounds write vulnerability in Samsung Open Source rlottie allows Overflow Buffers.
This issue affects rlottie: before dcfde72eae1b0464dc0dd760aec00ada6a148635.102dCVE-2026-880354.7 MED1.0%
——0A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.46dCVE-2026-83404.3 MED1.0%
——0Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion. Victim with edit_file_contents permission is CSRF'd into publishing an attacker-chosen previously-uploaded version (downgrade to an older version of a file, or activation of a co-editor's unpublished version). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.101dCVE-2024-31332—1.0%
——0——CVE-2025-319775.3 MED1.0%
——0HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness to decrypt or manipulate encrypted communications under certain conditions.37dCVE-2024-45561—1.0%
——0——CVE-2024-0052—1.0%
——0——CVE-2025-24493—1.0%
——0——CVE-2026-553026.7 MED1.0%
——0In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.41dCVE-2026-455207.8 ALT1.0%
——0In onAttach of BiometricsSettingsBase.java, there is a possible authentication bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.38dCVE-2025-369187.8 ALT1.0%
——0In aoc_service_read_message of aoc_ipc_core.c, there is a possible out of bounds read due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.25dCVE-2024-58049—1.0%
——0——CVE-2024-33038—1.0%
——0——CVE-2023-20850—1.0%
——0——CVE-2026-406025.6 MED1.0%
——0The Home Assistant Command-line interface (hass-cli) is a command-line tool for Home Assistant. Up to 1.0.0 of home-assitant-cli an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one. The user-supplied input within Jinja2 templates was rendered locally with no restrictions. This gave users access to Python's internals and extended the scope of templating beyond the intended usage. This vulnerability is fixed in 1.0.0.6dCVE-2023-21105—1.0%
——0——CVE-2025-47364—1.0%
——0——CVE-2026-587476.7 MED1.0%
——0In smmu_detach_dev of arm-smmu-v3.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.44dCVE-2024-23368—0.9%
——0——CVE-2022-26463—1.0%
——0——CVE-2023-21383—1.0%
——0——CVE-2026-32043—1.0%
——0——CVE-2026-252907.8 ALT1.0%
——0Memory Corruption when validating large data buffers from external sources using addition to check buffer length.40dCVE-2026-32918—1.0%
——0——CVE-2024-38420—1.0%
——0——CVE-2024-31324—1.0%
——0——CVE-2026-252648.8 ALT1.0%
——0Privilege escalation due to weak configuration during package extraction process.37dCVE-2026-59385.5 MED1.0%
——0Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of service.6dCVE-2026-59375.5 MED1.0%
——0Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an unhandled "std::invalid_argument" exception, ultimately causing the program to terminate.7dCVE-2026-1161582.5 BAJ1.0%
——0ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.6dCVE-2022-20393—1.0%
——0——CVE-2026-252838.8 ALT1.0%
——0Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size.40dCVE-2026-473196.1 MED1.0%
——0Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation.
This issue affects rlottie: before 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd.102dCVE-2024-45582—1.0%
——0——