CVE Watch406,199 en archivo total

Vulnerabilidades explotables hoy

406,199en la vista actual

Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.

En catálogo KEV1,766

Nuevos KEV · 24H0

Exploit Today ≥ 701,698

Distribución · última ventana

Crítico
5,581
Alto
21,731
Medio
20,262
Bajo
2,103

Filtros

Ventana

Severidad

Filtros

Vulnerabilidades396,921–396,960 · 406,199

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2025-473557.8 ALT

0.4%

——0Memory corruption while invoking remote procedure IOCTL calls.23d CVE-2023-21249—

0.4%

——0——CVE-2025-47327—

0.4%

——0——CVE-2026-1078574.4 MED

0.4%

——0Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtr_cloud_token and @mindwtr_webdav_password. A party with access to the application database or an exposed device backup can recover these credentials and use them to access the user's synchronized tasks and attachments. This issue is fixed in version 1.1.5.15d CVE-2022-48232—

0.4%

——0——CVE-2026-286117.8 ALT

0.4%

——0In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.46d CVE-2026-588747.8 ALT

0.4%

——0In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.37d CVE-2026-285727.8 ALT

0.4%

——0In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.46d CVE-2022-47367—

0.4%

——0——CVE-2026-620267.1 ALT

0.4%

——0Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Request Forgery.This issue affects Dashboard Notes: from n/a through 1.0.3.22d CVE-2026-1040344.7 MED

0.4%

——0A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos ticket can trigger this issue on systems configured with KCM renewal, causing the KCM responder service to crash and resulting in a Denial of Service (DoS).25d CVE-2026-0118—

0.4%

——0——CVE-2026-74394.4 MED

0.4%

——0AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation weakness through browser-driven or local cross-origin requests to abuse the localhost API and enable attack chains against the local control plane.5d CVE-2025-26419—

——0——CVE-2025-596156.6 MED

0.4%

——0Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization.32d CVE-2025-473477.8 ALT

0.4%

——0Memory corruption while processing control commands in the virtual memory management interface.23d CVE-2025-270487.8 ALT

0.4%

——0Memory corruption while processing camera platform driver IOCTL calls.23d CVE-2025-270748.8 ALT

0.4%

——0Memory corruption while processing a GP command response.13d CVE-2025-473547.8 ALT

0.4%

——0Memory corruption while allocating buffers in DSP service.23d CVE-2022-48371—

0.4%

——0——CVE-2026-286447.8 ALT

0.4%

——0In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.46d CVE-2026-664797.1 ALT

0.4%

——0Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.23d CVE-2026-963933.6 BAJ

0.4%

——0The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in an application crash.22d CVE-2025-59852—

0.4%

——0——CVE-2026-451615.4 MED

0.4%

——0wger is a free, open-source workout and fitness manager. Prior to version 2.6, the `trainer_login` view in wger accepts GET requests and executes `django_login()` without any CSRF protection, because Django's `CsrfViewMiddleware` only enforces tokens on unsafe methods (POST/PUT/PATCH/DELETE). An attacker can embed a single `<img>` tag on a malicious page; when an authenticated trainer loads that page, their browser auto-issues the GET with the session cookie, forcibly rebinding the trainer's session to an arbitrary user account. Version 2.6 fixes the issue.24d CVE-2026-348675.6 MED

0.4%

——0Double free vulnerability in the multi-mode input system. Impact: Successful exploitation of this vulnerability may affect availability.5d CVE-2022-47482—

——0——CVE-2026-814738.1 ALT

0.3%

——0Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.33d CVE-2026-861587.7 ALT

0.3%

——0Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel.32d CVE-2022-47357—