Vulnerabilidades explotables hoy
406,199en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,766
Nuevos KEV · 24H0
Exploit Today ≥ 701,698
Distribución · última ventana
- Crítico5,592
- Alto21,760
- Medio20,279
- Bajo2,104
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2025-40680—0.3%
——0——CVE-2022-21774—0.3%
——0——CVE-2024-49730—0.3%
——0——CVE-2023-21319—0.3%
——0——CVE-2024-27234—0.3%
——0——CVE-2022-47328—0.3%
——0——CVE-2025-277254.4 MED0.3%
——0Time-of-check time-of-use race condition for some ACAT before version 3.13 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.12dCVE-2025-207496.7 MED0.3%
——0In charger, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915493; Issue ID: MSV-3800.13dCVE-2026-40223—0.3%
——0——CVE-2021-0533—0.3%
——0——CVE-2024-43764—0.3%
——0——CVE-2025-473527.8 ALT0.3%
——0Memory corruption while processing audio streaming operations.13dCVE-2024-43064—0.3%
——0——CVE-2022-21775—0.3%
——0——CVE-2023-30916—0.3%
——0——CVE-2022-47329—0.3%
——0——CVE-2024-45548—0.3%
——0——CVE-2024-29750—0.3%
——0——CVE-2026-20444—0.3%
——0——CVE-2025-6177—0.3%
——0——CVE-2025-485557.8 ALT0.3%
——0In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.24dCVE-2023-30864—0.3%
——0——CVE-2023-40112—0.3%
——0——CVE-2025-473617.8 ALT0.3%
——0Memory corruption when triggering a subsystem crash with an out-of-range identifier.13dCVE-2025-270366.1 MED0.3%
——0Information disclosure when Video engine escape input data is less than expected minimum size.36dCVE-2026-20440—0.3%
——0——CVE-2025-323477.8 ALT0.3%
——0In onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.30dCVE-2023-30863—0.3%
——0——CVE-2026-20426—0.3%
——0——CVE-2025-54649—0.3%
——0——CVE-2022-21776—0.3%
——0——CVE-2025-270406.5 MED0.3%
——0Information disclosure may occur while processing the hypervisor log.23dCVE-2023-30929—0.3%
——0——CVE-2023-30928—0.3%
——0——CVE-2023-38554—0.3%
——0——CVE-2023-21382—0.3%
——0——CVE-2025-52645—0.3%
——0——CVE-2026-1063678.4 ALT0.3%
——0Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: Medium)17dCVE-2026-43342—0.3%
——0——CVE-2026-0392—0.3%
——0eParakstītājs 3.0 for Windows before version
1.10.0 retrieves and executes its automatic updates over a channel that is not
authenticated or integrity-protected. On each launch the application fetches an
update descriptor (XML) over TLS but accepts any TLS certificate (a permissive
TrustManager and a HostnameVerifier that always returns true), does not verify
any digital signature on the update descriptor, and does not verify the
Authenticode signature or a checksum of the downloaded installer before running
it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a
crafted update descriptor pointing to an attacker-controlled executable, which
the client downloads and executes, resulting in arbitrary code execution on the
victim host.8d