Vulnerabilidades explotables hoy
406,265en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,766
Nuevos KEV · 24H0
Exploit Today ≥ 701,698
Distribución · última ventana
- Crítico5,570
- Alto21,669
- Medio20,191
- Bajo2,099
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-410127.7 ALT0.8%
——0Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover.
An attacker who can intercept traffic between the BOSH Director and vCenter can establish a malicious server impersonating the vCenter REST API. When the BOSH Director makes CPI calls to perform routine cloud infrastructure operations, the attacker captures the vCenter administrator username and password transmitted via HTTP Basic authentication.
The vulnerability stems from insufficient authentication security in the communication protocol between BOSH Director and vCenter. While HTTPS may be used, the lack of proper certificate validation and pinning allows attackers to successfully impersonate vCenter endpoints. Because vCenter credentials typically grant full administrative control over the entire virtualization estate, successful credential capture yields complete takeover of every VM, datastore, and network the CPI manages.
This exposure exists on every CPI call (including routine deployment operations, not just when tags are configured) and cannot be mitigated by supplying a CA certificate alone. The attack impacts all infrastructure managed by the compromised vCenter instance, potentially affecting hundreds or thousands of VMs across multiple deployments and environments.59dCVE-2026-426454.3 MED0.8%
——0Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Cross Site Request Forgery.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.11.0.7dCVE-2025-27051—0.8%
——0——CVE-2026-1051184.7 MED0.8%
——0OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered post-logout URI, enabling phishing that borrows the OpenAM host's trust.26dCVE-2026-398106.0 MED0.8%
——0A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5 may allow attacker to information disclosure via decrypting database dump.6dCVE-2023-20839—0.8%
——0——CVE-2026-640057.8 ALT0.8%
——0In the Linux kernel, the following vulnerability has been resolved:
net/smc: Do not re-initialize smc hashtables
INIT_HLIST_HEAD(&smc_v*_hashinfo.ht) are called after smc_nl_init(),
proto_register() and sock_register(). This can lead to smc_v*_hashinfo.ht
being reset even though hash entries already exist and are being used,
possibly resulting in a corrupted list.
Remove unnecessary and dangerous re-initialisation of smc_v*_hashinfo.ht in
smc_init(); it is implicitly initialised to zero anyhow. Add
HLIST_HEAD_INIT to the definitions for clarity.13dCVE-2026-581007.0 ALT0.8%
——0kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read.
An unprivileged local user may be able to exploit these races to escalate privileges.13dCVE-2022-26435—0.8%
——0——CVE-2022-21791—0.8%
——0——CVE-2025-58922—0.8%
——0——CVE-2025-623383.3 BAJ0.8%
——0HCL BigFix Cloud Lifecycle Management is affected by lack of input validation. This low-level flaw allows unauthorized access and may lead to information exposure.102dCVE-2026-46112—0.8%
——0——CVE-2023-20844—0.8%
——0——CVE-2022-26432—0.8%
——0——CVE-2025-22405—0.8%
——0——CVE-2022-21790—0.8%
——0——CVE-2025-27043—0.8%
——0——CVE-2024-43063—0.8%
——0——CVE-2024-31334—0.8%
——0——CVE-2023-32808—0.8%
——0——CVE-2026-869387.3 ALT0.8%
——0A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated administrator privileges by placing a malicious DLL file in the installer directory. This vulnerability is addressed in FileMaker Pro version 26.0.3.27dCVE-2025-1787—0.8%
——0——CVE-2022-20281—0.8%
——0——CVE-2022-1318—0.8%
——0——CVE-2023-21024—0.8%
——0——CVE-2026-0119—0.8%
——0——CVE-2022-26430—0.8%
——0——CVE-2026-461577.8 ALT0.8%
——0In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
Currently the runtime.oss.trigger field may be accessed concurrently
without protection, which may lead to the data race. And, in this
case, it may lead to more severe problem because it's a bit field; as
writing the data, it may overwrite other bit fields as well, which
confuses the operation completely, as spotted by fuzzing.
Fix it by covering runtime.oss.trigger bit fled also with the existing
params_lock mutex in both snd_pcm_oss_get_trigger() and
snd_pcm_oss_poll().2dCVE-2024-31336—0.8%
——0——CVE-2025-22410—0.8%
——0——CVE-2023-20236—0.8%
——0——CVE-2026-55155.5 MED0.8%
——0IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 stores potentially sensitive information in log files that could be read by a local user.18dCVE-2025-27701—0.8%
——0——CVE-2023-44129—0.8%
——0——CVE-2026-313693.2 BAJ0.8%
——0PcManager is affected by type privilege bypass, successful exploitation of this vulnerability may affect service availability6dCVE-2023-20845—0.8%
——0——CVE-2023-21483—0.8%
——0——CVE-2023-35655—0.8%
——0——CVE-2023-32810—0.8%
——0——