Vulnerabilidades exploráveis hoje
413,525na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,779
Novos KEV · 24H0
Exploit Today ≥ 701,707
Distribuição · última janela
- Crítica5,739
- Alta22,705
- Média21,204
- Baixa2,175
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2022-34120—97.4%
——29——CVE-2009-4073—97.4%
——29——CVE-2019-16279—97.4%
——29——CVE-2016-7235—97.4%
——29——CVE-2017-8507—97.4%
——29——CVE-2005-3207—97.4%
——29——CVE-2020-11117—97.4%
——29——CVE-2025-61928—97.4%
——29Better Auth is an authentication and authorization library for TypeScript. In versions prior to 1.3.26, unauthenticated attackers can create or modify API keys for any user by passing that user's id in the request body to the `api/auth/api-key/create` route. `session?.user ?? (authRequired ? null : { id: ctx.body.userId })`. When no session exists but `userId` is present in the request body, `authRequired` becomes false and the user object is set to the attacker-controlled ID. Server-only field validation only executes when `authRequired` is true (lines 280-295), allowing attackers to set privileged fields. No additional authentication occurs before the database operation, so the malicious payload is accepted. The same pattern exists in the update endpoint. This is a critical authentication bypass enabling full an unauthenticated attacker can generate an API key for any user and immediately gain complete authenticated access. This allows the attacker to perform any action as the victim user using the api key, potentially compromise the user data and the application depending on the victim's privileges. Version 1.3.26 contains a patch for the issue.24dCVE-2008-1201—97.4%
——29——CVE-2009-0949—97.4%
——29——CVE-2018-8504—97.4%
——29——CVE-2018-1011—97.4%
——29——CVE-2016-6175—97.4%
——29——CVE-2023-513856.5 MÉD97.4%
——29In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.28dCVE-2010-1349—97.4%
——29——CVE-2018-5726—97.4%
——29——CVE-2017-8691—97.4%
——29——CVE-2002-0623—97.4%
——29——CVE-2016-0182—97.4%
——29——CVE-2019-16701—97.4%
——29——CVE-2006-5710—97.4%
——29——CVE-2018-74899.8 CRÍ97.4%
——29FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.27dCVE-2019-9204—97.4%
——29——CVE-2018-12871—97.4%
——29——CVE-2017-6168—97.4%
——29——CVE-2016-3284—97.4%
——29——CVE-2023-27853—97.4%
——29——CVE-2026-3661—97.4%
——29——CVE-2015-6142—97.4%
——29——CVE-2011-0364—97.4%
——29——CVE-2014-4068—97.4%
——29——CVE-2015-0091—97.4%
——29——CVE-2018-16287—97.4%
——29——CVE-2007-4916—97.4%
——29——CVE-2018-16060—97.4%
——29——CVE-2019-19742—97.4%
——29——CVE-2016-0126—97.4%
——29——CVE-2002-1426—97.4%
——29——CVE-2015-1067—97.4%
——29——CVE-2019-8385—97.4%
——29——