Vulnerabilidades exploráveis hoje
410,305na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,769
Novos KEV · 24H0
Exploit Today ≥ 701,700
Distribuição · última janela
- Crítica5,510
- Alta20,947
- Média20,093
- Baixa2,062
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2022-322054.3 MÉD98.3%
——29A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.26dCVE-2022-2564—98.3%
——29——CVE-2024-503799.8 CRÍ98.3%
——29Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.6dCVE-2009-2512—98.3%
——29——CVE-2022-24463—98.3%
——29——CVE-2009-1137—98.3%
——29——CVE-2015-8048—98.3%
——29——CVE-2013-0007—98.3%
——29——CVE-2025-50154—98.3%
——29——CVE-2009-1029—98.3%
——29——CVE-2009-1960—98.3%
——29——CVE-2022-45092—98.3%
——29——CVE-2015-2460—98.3%
——29——CVE-2019-13024—98.3%
——29——CVE-2018-10718—98.3%
——29——CVE-2023-3001—98.3%
——29——CVE-2025-54136—98.3%
——29——CVE-2026-4167910.0 CRÍ98.3%
——29Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authenticated` mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default deployment configuration. Version 2026.416.0 patches the issue.15dCVE-2020-4463—98.3%
——29——CVE-2025-117007.5 ALT98.3%
——29N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure17dCVE-2007-2244—98.3%
——29——CVE-2018-7777—98.3%
——29——CVE-2018-20251—98.3%
——29——CVE-2022-24989—98.3%
——29——CVE-2013-3120—98.3%
——29——CVE-2024-44334—98.3%
——29——CVE-2006-4697—98.3%
——29——CVE-2009-4498—98.3%
——29——CVE-2008-0011—98.3%
——29——CVE-2007-5363—98.3%
——29——CVE-2011-0097—98.3%
——29——CVE-2007-1747—98.3%
——29——CVE-2008-0376—98.3%
——29——CVE-2018-12827—98.3%
——29——CVE-2012-1525—98.3%
——29——CVE-2014-1683—98.3%
——29——CVE-2022-28054—98.3%
——29——CVE-2007-5511—98.3%
——29——CVE-2015-8412—98.3%
——29——CVE-2009-4962—98.3%
——29——