PULSE
ESEN
FEED
ransomn0n reclama a Company #147 · USransomn0n reclama a Company #146 · USransomn0n reclama a Company #145 · USransomn0n reclama a Company #144 · USransomn0n reclama a Company #143 · USransomn0n reclama a Company #142 · KRransomn0n reclama a Company #141 · USransomn0n reclama a Company #140 · CAransomn0n reclama a Company #139 · USransomn0n reclama a Company #138 · CAransomsafepay reclama a by.zivor.co.il · ILransomqilin reclama a XK net SA de CV · MXransomqilin reclama a BOSH Engineering Private Limited · SG · Manufacturingransomqilin reclama a J. J. Louro Pereira · PT · Otherransomn0n reclama a Company #147 · USransomn0n reclama a Company #146 · USransomn0n reclama a Company #145 · USransomn0n reclama a Company #144 · USransomn0n reclama a Company #143 · USransomn0n reclama a Company #142 · KRransomn0n reclama a Company #141 · USransomn0n reclama a Company #140 · CAransomn0n reclama a Company #139 · USransomn0n reclama a Company #138 · CAransomsafepay reclama a by.zivor.co.il · ILransomqilin reclama a XK net SA de CV · MXransomqilin reclama a BOSH Engineering Private Limited · SG · Manufacturingransomqilin reclama a J. J. Louro Pereira · PT · Other
CVE Watch409.857 no arquivo completo

Vulnerabilidades exploráveis hoje

409,857na visualização atual

Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.

No catálogo KEV1,769
Novos KEV · 24H0
Exploit Today ≥ 701,700

Distribuição · última janela

  • Crítica
    5,527
  • Alta
    21,044
  • Média
    20,197
  • Baixa
    2,086
Filtros
Filtros

Janela

Severidade

Filtros

Vulnerabilidades409,841–409,857 · 409,857
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2025-34610—
—
———Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.4hCVE-2025-34611—
—
———Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.4hCVE-2025-34612—
—
———Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.4hCVE-2025-34613—
—
———Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.4hCVE-2025-34614—
—
———Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.4hCVE-2025-34615—
—
———Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.4hCVE-2026-1235414.7 MÉD
—
———OpenAM before 16.1.4 contains an open redirect vulnerability that allows remote attackers to redirect users after SAML 1.x single sign-on by exploiting loose trusted-partner destination matching. Attackers can craft links to /SAMLAwareServlet or /SAMLPOSTProfileServlet with a destination host resembling a trusted partner to send authenticated users to attacker-controlled phishing sites.1hCVE-2026-1235426.8 MÉD
—
———OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code verifier when device codes are exchanged for tokens. Attackers who obtain an approved device code from client logs or shared device storage can redeem it for access and ID tokens to impersonate the user.1hCVE-2026-1235437.5 ALT
—
———OpenAM before 16.1.4 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending serialized Java data without size or structure limits. Attackers can send small crafted requests to remote SDK endpoints, classic login pages, or the administration console to block authentication, session validation and policy decisions.1hCVE-2026-1235446.8 MÉD
—
———OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving processes, tamper with writable files, and possibly execute code.1hCVE-2025-34616—
—
———Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.4hCVE-2025-34617—
—
———Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.4hCVE-2026-1235457.1 ALT
—
———OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user to a crafted page, obtaining access and ID tokens to call APIs as that user.1hCVE-2025-34618—
—
———Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.4hCVE-2025-34619—
—
———Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.4hCVE-2026-1235717.5 ALT
—
———Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows remote attackers to trigger a panic via malformed records. Attackers can send a crafted TSIG record in DNS wire format to cause unchecked subtraction underflow, crashing builds with overflow checks enabled and causing denial of service.1hCVE-2025-34620—
—
———Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.4h