Vulnerabilidades exploráveis hoje
413,612na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,779
Novos KEV · 24H0
Exploit Today ≥ 701,707
Distribuição · última janela
- Crítica5,740
- Alta22,744
- Média21,228
- Baixa2,176
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2016-4177—97.2%
——29——CVE-2014-0267—97.2%
——29——CVE-2024-22263—97.2%
——29——CVE-2022-30808—97.2%
——29——CVE-2016-4176—97.2%
——29——CVE-2018-16660—97.2%
——29——CVE-2023-26602—97.2%
——29——CVE-2016-3359—97.2%
——29——CVE-2012-4787—97.2%
——29——CVE-2020-36112—97.2%
——29——CVE-2021-33357—97.2%
——29——CVE-2015-1605—97.2%
——29——CVE-2015-3897—97.2%
——29——CVE-2025-31121—97.2%
——29——CVE-2025-4111510.0 CRÍ97.2%
——29SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.
In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation.
This vulnerability applies only if all of the following conditions are met:
- `enableSCIM` feature flag set to true
- `user_sync_enabled` config option in the `[auth.scim]` block set to true24dCVE-2022-29632—97.2%
——29——CVE-2026-412689.8 CRÍ97.2%
——29Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override bypass using the FILE-STORAGE:: keyword combined with a NODE_OPTIONS environment variable injection. This allows for the execution of arbitrary system commands with root privileges within the containerized Flowise instance, requiring only a single HTTP request and no authentication or knowledge of the instance. This vulnerability is fixed in 3.1.0.16dCVE-2025-6793—97.2%
——29——CVE-2001-0546—97.2%
——29——CVE-2004-0892—97.2%
——29——CVE-2024-47855—97.2%
——29——CVE-2016-3362—97.2%
——29——CVE-2012-0271—97.2%
——29——CVE-2019-5533—97.2%
——29——CVE-2021-24040—97.2%
——29——CVE-2005-2308—97.2%
——29——CVE-2025-6898—97.2%
——29——CVE-2020-6637—97.2%
——29——CVE-2013-1839—97.2%
——29——CVE-2009-3019—97.2%
——29——CVE-2001-0721—97.2%
——29——CVE-2001-0017—97.2%
——29——CVE-2015-1672—97.2%
——29——CVE-2015-0921—97.2%
——29——CVE-2013-5045—97.2%
——29——CVE-2024-10456—97.2%
——29——CVE-1999-1035—97.2%
——29——CVE-2023-27394—97.2%
——29——CVE-2021-39842—97.2%
——29——CVE-2018-18065—97.2%
——29——