Vulnerabilidades exploráveis hoje
410,117na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,769
Novos KEV · 24H0
Exploit Today ≥ 701,700
Distribuição · última janela
- Crítica5,499
- Alta20,885
- Média20,028
- Baixa2,062
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2013-1884—98.9%
——30——CVE-2009-1536—98.9%
——30——CVE-2007-0009—98.9%
——30——CVE-2021-3287—98.9%
——30——CVE-2007-4336—98.9%
——30——CVE-2022-23943—98.9%
——30——CVE-2020-28579—98.9%
——30——CVE-2016-0956—98.9%
——30——CVE-2019-12527—98.9%
——30——CVE-2015-5133—98.9%
——30——CVE-2025-684938.1 ALT98.9%
——30Missing XML Validation vulnerability in Apache Struts, Apache Struts.
This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.
Users are recommended to upgrade to version 6.1.1, which fixes the issue.117dCVE-2021-44427—98.9%
——30——CVE-2024-25735—98.9%
——30——CVE-2021-35594—98.9%
——30——CVE-2021-28635—98.9%
——30——CVE-2021-34646—98.9%
——30——CVE-2017-13772—98.9%
——30——CVE-2024-2862—98.9%
——30——CVE-2008-1365—98.9%
——30——CVE-2024-5084—98.9%
——30——CVE-2017-16720—98.9%
——30——CVE-2008-0111—98.9%
——30——CVE-2022-26960—98.9%
——30——CVE-2025-3833—98.9%
——30——CVE-2020-7046—98.9%
——30——CVE-2024-56511—98.9%
——30——CVE-2016-53888.1 ALT98.9%
——30Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.25dCVE-2010-4052—98.9%
——30——CVE-2017-7925—98.9%
——30——CVE-2000-0869—98.9%
——30——CVE-2010-0033—98.9%
——30——CVE-2007-1567—98.9%
——30——CVE-2009-4655—98.9%
——30——CVE-2014-1823—98.9%
——30——CVE-2023-34124—98.9%
——30——CVE-2026-534358.8 ALT98.9%
——30In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards.
This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.14dCVE-2020-15050—98.9%
——30——CVE-2006-1551—98.9%
——30——CVE-2017-8751—98.9%
——30——CVE-2015-8256—98.9%
——30——