Vulnerabilidades exploráveis hoje
413,612na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,779
Novos KEV · 24H0
Exploit Today ≥ 701,707
Distribuição · última janela
- Crítica5,728
- Alta22,707
- Média21,208
- Baixa2,163
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2021-27156—96.8%
——29——CVE-2014-4106—96.8%
——29——CVE-2023-38925—96.8%
——29——CVE-2020-12695—96.8%
——29——CVE-2016-7243—96.8%
——29——CVE-2018-2799—96.8%
——29——CVE-2004-1308—96.8%
——29——CVE-2023-20238—96.8%
——29——CVE-2007-6682—96.8%
——29——CVE-2010-1688—96.8%
——29——CVE-2019-13605—96.8%
——29——CVE-2016-5228—96.8%
——29——CVE-2013-2471—96.8%
——29——CVE-2019-1019—96.8%
——29——CVE-2025-53119—96.8%
——29——CVE-2019-7127—96.8%
——29——CVE-2018-7074—96.8%
——29——CVE-2019-7109—96.8%
——29——CVE-2019-20372—96.8%
——29——CVE-2024-10392—96.8%
——29——CVE-2019-12569—96.8%
——29——CVE-2019-7110—96.8%
——29——CVE-2025-21309—96.8%
——29——CVE-2011-1244—96.8%
——29——CVE-2026-17176—96.8%
——29An OS
command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an
adjacent network attacker to execute arbitrary commands with root privileges by
sending a crafted UDP packet.
Successful exploitation may lead to complete
device compromise, including unauthorized command execution, modification of
device settings, and loss of confidentiality, integrity, and availability42dCVE-2002-0974—96.8%
——29——CVE-2001-0339—96.8%
——29——CVE-2018-0744—96.8%
——29——CVE-2025-6463—96.8%
——29——CVE-2024-35517—96.8%
——29——CVE-2002-1187—96.8%
——29——CVE-2022-36957—96.8%
——29——CVE-2010-1533—96.8%
——29——CVE-2018-8531—96.8%
——29——CVE-2001-0555—96.8%
——29——CVE-2022-1391—96.8%
——29——CVE-2017-8990—96.8%
——29——CVE-2023-29464—96.8%
——29——CVE-2024-13985—96.8%
——29A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the capture_handle.action interface. The flaw stems from improper input validation in the captureCommand parameter, which is processed without sanitization or authentication. By sending crafted HTTP requests, attackers can inject OS-level commands that are executed on the server, leading to full system compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-04-06 UTC.47dCVE-2025-21293—96.8%
——29——