Vulnerabilidades exploráveis hoje
413,525na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,779
Novos KEV · 24H0
Exploit Today ≥ 701,707
Distribuição · última janela
- Crítica5,739
- Alta22,705
- Média21,204
- Baixa2,175
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2010-3143—97.6%
——29——CVE-2011-3200—97.6%
——29——CVE-2017-8511—97.6%
——29——CVE-2005-3204—97.6%
——29——CVE-2006-4495—97.6%
——29——CVE-2007-0878—97.6%
——29——CVE-2013-1327—97.6%
——29——CVE-2024-34219—97.6%
——29——CVE-2014-1784—97.6%
——29——CVE-2018-8460—97.6%
——29——CVE-2014-1786—97.6%
——29——CVE-2000-096710.0 SEM97.6%
——29PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs.50dCVE-2011-2383—97.6%
——29——CVE-2012-2556—97.6%
——29——CVE-2018-0920—97.6%
——29——CVE-2026-26528.6 ALT97.6%
——29A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes, leaving other routes such as the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the `_find_fastapi_validator()` function fails to handle non-`/gateway/` paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0.8hCVE-2013-1311—97.6%
——29——CVE-2008-4268—97.6%
——29——CVE-2017-5641—97.6%
——29——CVE-2018-5159—97.6%
——29——CVE-2026-226799.8 CRÍ97.6%
——29Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).16dCVE-2013-0095—97.6%
——29——CVE-2002-0084—97.6%
——29——CVE-2003-0909—97.6%
——29——CVE-2014-0304—97.6%
——29——CVE-2015-0093—97.6%
——29——CVE-2013-1307—97.6%
——29——CVE-2014-1781—97.6%
——29——CVE-2018-6481—97.6%
——29——CVE-2010-0555—97.6%
——29——CVE-2006-4812—97.6%
——29——CVE-2000-0073—97.6%
——29——CVE-2023-24734—97.6%
——29——CVE-2013-1323—97.6%
——29——CVE-2011-3401—97.6%
——29——CVE-2024-9076—97.6%
——29——CVE-2018-1029—97.6%
——29——CVE-2020-25237—97.6%
——29——CVE-2016-3271—97.6%
——29——CVE-2022-27228—97.6%
——29——