Vulnerabilidades exploráveis hoje
413,612na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,779
Novos KEV · 24H0
Exploit Today ≥ 701,707
Distribuição · última janela
- Crítica5,693
- Alta22,630
- Média21,130
- Baixa2,150
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2022-33174—96.6%
——29——CVE-2024-28999—96.6%
——29——CVE-2017-8676—96.6%
——29——CVE-2008-2798—96.6%
——29——CVE-2003-1228—96.6%
——29——CVE-2016-6883—96.6%
——29——CVE-2022-43663—96.6%
——29——CVE-2017-11395—96.6%
——29——CVE-2010-1175—96.6%
——29——CVE-2020-3716—96.6%
——29——CVE-2010-0944—96.6%
——29——CVE-2002-0799—96.6%
——29——CVE-2025-4270—96.6%
——29——CVE-2019-1149—96.6%
——29——CVE-2015-2068—96.6%
——29——CVE-2021-29212—96.6%
——29——CVE-2021-21800—96.6%
——29——CVE-2013-3526—96.6%
——29——CVE-2022-3387—96.6%
——29——CVE-2018-10350—96.6%
——29——CVE-2016-5679—96.6%
——29——CVE-2025-1103—96.6%
——29——CVE-2006-4627—96.6%
——29——CVE-2010-1308—96.6%
——29——CVE-2026-438257.3 ALT96.6%
——29Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel
Versions Affected:
before 3.0.0-M4 (libsvm document categorization module; introduced in
OPENNLP-1808 and only present on the 3.x line)
Description:
SvmDoccatModel.deserialize(InputStream) reads an attacker-controlled
stream with java.io.ObjectInputStream and calls readObject() without an
ObjectInputFilter installed. ObjectInputStream materialises every class
referenced in the stream before the resulting object is cast to
SvmDoccatModel, so the cast that follows readObject() executes only
after the foreign object graph has already been deserialised in full.
If a Java deserialization gadget chain is available on the consumer's
classpath, a crafted payload supplied to
deserialize() executes arbitrary code in the JVM that loads it. Apache
OpenNLP itself does not ship a known gadget chain, so the realistic
risk is to downstream applications that embed the libsvm module
alongside vulnerable transitive dependencies. The method is public and
static, so any caller can pass an untrusted stream to it directly.
The practical impact is remote code execution against processes that
load SvmDoccatModel instances from untrusted or semi-trusted origins.
Mitigation:
3.x users should upgrade to 3.0.0-M4.
Users who cannot upgrade immediately should treat all serialized
SvmDoccatModel streams as untrusted input unless their provenance is
verified, and should avoid invoking SvmDoccatModel.deserialize() on
streams supplied by end users or fetched from third-party sources
without integrity checks.18dCVE-2023-25437—96.6%
——29——CVE-2013-44446.8 SEM96.6%
——29Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.34dCVE-2018-4404—96.6%
——29——CVE-2010-2891—96.6%
——29——CVE-2002-1141—96.6%
——29——CVE-2015-2098—96.6%
——29——CVE-2018-0710—96.6%
——29——CVE-2021-27179—96.6%
——29——CVE-2007-0444—96.6%
——29——CVE-2019-12419—96.6%
——29——CVE-2015-4551—96.6%
——29——CVE-2016-0110—96.6%
——29——CVE-2009-1257—96.6%
——29——CVE-2006-5142—96.6%
——29——CVE-2015-6047—96.6%
——29——