Vulnerabilidades explotables hoy
406,265en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,766
Nuevos KEV · 24H0
Exploit Today ≥ 701,698
Distribución · última ventana
- Crítico5,575
- Alto21,683
- Medio20,205
- Bajo2,100
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-0024—0.8%
——0——CVE-2024-321104.3 MED0.8%
——0Cross-Site request forgery (CSRF) vulnerability in Magepeople inc. WpEvently allows Cross Site Request Forgery.
This issue affects WpEvently: from n/a through 4.1.2.101dCVE-2026-0032—0.8%
——0——CVE-2026-1026777.8 ALT0.8%
——0Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.24dCVE-2026-410095.8 MED0.8%
——0When the director sends a long-running request (e.g. compile_package), the agent's reply JSON is consumed by AgentClient. inject_compile_log (line 332-339) reads response['value']['result']['compile_log_id'] and format_exception (line 318-325) reads exception['blobstore_id']; both pass the agent-supplied string unmodified to download_and_delete_blob(blob_id) (line 344-349), which calls @resource_manager.get_resource(blob_id) and, in an ensure block, @resource_manager.delete_resource(blob_id). Api::ResourceManager forwards the id straight to blobstore.get(id) / blobstore.delete(id). When the director is configured with the local blobstore provider, Blobstore::LocalClient#object_file_path(oid) is File.join(@blobstore_path, oid) (local_client.rb:54-56) with no normalisation, so oid = "../../jobs/director/config/director.yml" resolves outside the blobstore root.
Affected versions:
BOSH Director: All versions prior to v282.1.126dCVE-2025-323317.8 ALT0.8%
——0In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.32dCVE-2022-20340—0.8%
——0——CVE-2023-42720—0.8%
——0——CVE-2024-58117—0.8%
——0——CVE-2025-48520—0.8%
——0——CVE-2023-35677—0.8%
——0——CVE-2022-20316—0.8%
——0——CVE-2026-99877.8 ALT0.8%
——0Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 148.0.7778.216 allowed a local attacker to execute arbitrary code via a malicious file. (Chromium security severity: High)103dCVE-2026-20107—0.8%
——0——CVE-2023-33090—0.8%
——0——CVE-2022-33688—0.8%
——0——CVE-2023-20609—0.8%
——0——CVE-2026-1175345.4 MED0.8%
——0REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex_history_function=snap, permanently deleting all article snapshots or reverting articles to earlier states.5dCVE-2026-1168955.4 MED0.8%
——0REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safe_mode: false to config.yml, or enable session safe mode, disabling backend addons.5dCVE-2026-539004.3 MED0.8%
——0Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies into requests to an unrelated target domain. This vulnerability was fixed in Firefox for iOS 152.0.6dCVE-2025-53175—0.8%
——0——CVE-2022-33698—0.8%
——0——CVE-2026-1115827.3 ALT0.8%
——0A DLL loading vulnerability in the
TeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1
allows a local authenticated attacker with low privileges to execute arbitrary
code with elevated privileges. Exploitation requires user interaction.4dCVE-2022-20112—0.8%
——0——CVE-2022-48462—0.8%
——0——CVE-2023-33883—0.8%
——0——CVE-2022-21764—0.8%
——0——CVE-2022-20339—0.8%
——0——CVE-2022-27831—0.8%
——0——CVE-2026-34764—0.8%
——0——CVE-2023-21375—0.8%
——0——CVE-2024-25991—0.8%
——0——CVE-2023-21241—0.8%
——0——CVE-2023-33900—0.8%
——0——CVE-2026-499197.8 ALT0.8%
——0In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.38dCVE-2022-33687—0.8%
——0——CVE-2022-48464—0.8%
——0——CVE-2025-53172—0.8%
——0——CVE-2023-48411—0.8%
——0——CVE-2024-42033—0.8%
——0——