Vulnerabilidades explotables hoy
406,233en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,766
Nuevos KEV · 24H0
Exploit Today ≥ 701,698
Distribución · última ventana
- Crítico5,579
- Alto21,700
- Medio20,217
- Bajo2,100
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2023-20651—0.5%
——0——CVE-2023-32884—0.5%
——0——CVE-2023-20729—0.5%
——0——CVE-2023-20694—0.5%
——0——CVE-2023-20626—0.5%
——0——CVE-2024-23704—0.5%
——0——CVE-2021-39629—0.5%
——0——CVE-2024-29743—0.5%
——0——CVE-2023-21312—0.5%
——0——CVE-2022-38674—0.5%
——0——CVE-2025-4618—0.5%
——0A sensitive information disclosure vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to retrieve sensitive data from Prisma Browser.
Browser self-protection should be enabled to mitigate this issue.24dCVE-2023-21271—0.5%
——0——CVE-2026-471665.7 MED0.5%
——0ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-read in the server process. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.101dCVE-2026-240888.2 ALT0.5%
——0Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader.102dCVE-2026-1076784.7 MED0.5%
——0FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.17dCVE-2023-21198—0.5%
——0——CVE-2022-47344—0.5%
——0——CVE-2025-14575—0.5%
——0An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.18dCVE-2023-20664—0.5%
——0——CVE-2026-784046.5 MED0.5%
——0IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.19dCVE-2023-20135—0.5%
——0——CVE-2026-23165—0.5%
——0——CVE-2025-64456—0.5%
——0——CVE-2026-24925—0.5%
——0——CVE-2022-47342—0.5%
——0——CVE-2022-47345—0.5%
——0——CVE-2021-39735—0.5%
——0——CVE-2023-42744—0.5%
——0——CVE-2023-20828—0.5%
——0——CVE-2023-20832—0.5%
——0——CVE-2025-207217.8 ALT0.5%
——0In imgsensor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10089545; Issue ID: MSV-4279.24dCVE-2018-9371—0.5%
——0——CVE-2025-207237.8 ALT0.5%
——0In gnss driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920033; Issue ID: MSV-3797.24dCVE-2026-1153933.8 BAJ0.5%
——0Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APIs fail to validate that objects belong to the Store's Engine. Embedders mixing objects between Engines via Instance::new, StructRefPre::new, or Tag::new can trigger trampoline signature mismatches causing out-of-bounds stack writes, GC heap corruption, or panics.3dCVE-2026-337765.5 MED0.5%
——0A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a local user with low privileges to read sensitive information.
A local user with low privileges can execute the CLI command 'show mgd' with specific arguments which will expose sensitive information.
This issue affects
Junos OS:
* all versions before 22.4R3-S8,
* 23.2 versions before 23.2R2-S6,
* 23.4 versions before 23.4R2-S6,
* 24.2 versions before 24.2R2-S4,
* 24.4 versions before 24.4R2-S1,
* 25.2 version before 25.2R1-S2, 25.2R2;
Junos OS Evolved:
* all versions before 23.2R2-S6-EVO,
* 23.4 version before 23.4R2-S6-EVO,
* 24.2 version before 24.2R2-S4-EVO,
* 24.4 versions before 24.4R2-S1-EVO,
* 25.2 versions before 25.2R2-EVO.5dCVE-2025-20645—0.5%
——0——CVE-2026-466924.1 MED0.5%
——0ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-write in the server process. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.101dCVE-2026-361767.1 ALT0.5%
——0GNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in plaintext to the serial console. This allows physically-proximate attackers to extract these active tokens to perform unauthorized operations via monitoring the serial UART interface.101dCVE-2026-233024.7 MED0.5%
——0In the Linux kernel, the following vulnerability has been resolved:
net: annotate data-races around sk->sk_{data_ready,write_space}
skmsg (and probably other layers) are changing these pointers
while other cpus might read them concurrently.
Add corresponding READ_ONCE()/WRITE_ONCE() annotations
for UDP, TCP and AF_UNIX.17dCVE-2026-923747.8 ALT0.5%
——0A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.4d