Vulnerabilidades explotables hoy
406,192en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,766
Nuevos KEV · 24H0
Exploit Today ≥ 701,698
Distribución · última ventana
- Crítico5,623
- Alto21,844
- Medio20,400
- Bajo2,119
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2025-208026.7 MED0.2%
——0In geniezone, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10238968; Issue ID: MSV-4914.24dCVE-2025-41762—0.2%
——0——CVE-2025-207876.7 MED0.2%
——0In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10149879; Issue ID: MSV-4658.24dCVE-2022-0247—0.2%
——0——CVE-2023-21082—0.2%
——0——CVE-2026-10685.3 MED0.2%
——0An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of intercepting network traffic to obtain sensitive user data from the application.73dCVE-2023-40650—0.2%
——0——CVE-2018-9428—0.2%
——0——CVE-2023-21142—0.2%
——0——CVE-2023-48356—0.2%
——0——CVE-2025-20776—0.2%
——0——CVE-2025-26449—0.2%
——0——CVE-2023-20726—0.2%
——0——CVE-2026-424084.4 MED0.2%
——0When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.5dCVE-2018-9369—0.2%
——0——CVE-2026-285823.3 BAJ0.2%
——0In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.46dCVE-2025-471475.7 MED0.2%
——0Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in Operator's mobile device to extract the session token and exploit access for a limited duration.
This issue affects Command Centre Mobile Client versions prior to 9.40.123.78dCVE-2023-48359—0.2%
——0——CVE-2023-38466—0.2%
——0——CVE-2024-56184—0.2%
——0——CVE-2025-9142—0.2%
——0——CVE-2025-486327.8 ALT0.2%
——0In setDisplayName of AssociationRequest.java, there is a possible way to cause CDM associations to persist after the user has disassociated them due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.24dCVE-2024-20116—0.2%
——0——CVE-2023-40113—0.2%
——0——CVE-2026-00877.8 ALT0.2%
——0In approvalLevelForDomainInternal of DomainVerificationService.java, there is a possible way to hijack an arbitrary app link due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.101dCVE-2023-21091—0.2%
——0——CVE-2025-486015.5 MED0.2%
——0In multiple locations, there is a possible permanent denial of service due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.24dCVE-2023-42655—0.2%
——0——CVE-2023-20825—0.2%
——0——CVE-2026-261037.1 ALT0.2%
——0A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.108dCVE-2025-36900—0.2%
——0——CVE-2022-20097—0.2%
——0——CVE-2026-60667.1 ALT0.2%
——0ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This could allow network‑based interception of Solution Center traffic in Automate deployments. The issue has been resolved in Automate 2026.4 by enforcing secure communication for affected Solution Center connections.5dCVE-2024-20140—0.2%
——0——CVE-2024-29780—0.2%
——0——CVE-2018-9412—0.2%
——0——CVE-2026-1065892.9 BAJ0.2%
——0In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged allocation of PTY devices.24dCVE-2018-9376—0.2%
——0——CVE-2023-40105—0.2%
——0——CVE-2025-48577—0.2%
——0——