Vulnerabilidades exploráveis hoje
17,564na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,769
Novos KEV · 24H0
Exploit Today ≥ 701,700
Distribuição · última janela
- Crítica5,645
- Alta21,875
- Média21,293
- Baixa2,178
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1094537.0 ALT20.5%
——6Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.11dCVE-2026-1094298.8 ALT46.9%
——14Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as embedding a command substitution within a single-quoted variable and re-expanding it with the ${var@P} prompt-transform operator so bash's promptvars feature executes the hidden command at runtime while only the trailing allowlisted command is classified, resulting in silent arbitrary command execution with the privileges of the agent's terminal session.21dCVE-2026-1094288.8 ALT43.6%
——13Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the _extract_commands() function of bash.py. Attackers can craft a command string where tree-sitter-bash extracts only an allowlisted prefix such as cd while bash joins the line continuation into a materially different and hidden command such as a curl request, causing resolve_permission to grant ALWAYS permission while bash executes unauthorized arbitrary commands.11dCVE-2026-1084718.8 ALT30.7%
——9Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.11dCVE-2026-1084687.0 ALT20.5%
——6Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.11dCVE-2026-1084678.8 ALT63.1%
——19Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network.11dCVE-2026-1084665.3 MÉD53.4%
——16Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over a network.11dCVE-2026-1084657.0 ALT20.5%
——6Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally.11dCVE-2026-1084647.0 ALT20.5%
——6Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.11dCVE-2026-1084638.8 ALT62.2%
——19Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.11dCVE-2026-1084625.5 MÉD59.6%
——18Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.11dCVE-2026-1084617.0 ALT20.5%
——6Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.11dCVE-2026-1084608.1 ALT55.6%
——17Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.11dCVE-2026-1084588.8 ALT58.4%
——18Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.11dCVE-2026-1084578.1 ALT55.6%
——17Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.11dCVE-2026-1084008.8 ALT60.0%
——18Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.24dCVE-2026-1083997.2 ALT32.4%
——10Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.10dCVE-2026-1083988.8 ALT56.1%
——17Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.24dCVE-2026-1083967.0 ALT11.8%
——4Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.14dCVE-2026-1081367.8 ALT30.5%
——9Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.14dCVE-2026-1081357.0 ALT22.8%
——7Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.14dCVE-2026-1081347.0 ALT20.5%
——6Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.10dCVE-2026-1081337.8 ALT29.1%
——9Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.10dCVE-2026-1081327.0 ALT20.5%
——6Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.14dCVE-2026-1081317.5 ALT58.8%
——18No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.21dCVE-2026-1081307.8 ALT30.7%
——9Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.10dCVE-2026-1081296.5 MÉD65.2%
——20Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.21dCVE-2026-1081286.5 MÉD65.2%
——20Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.21dCVE-2026-1081276.5 MÉD65.2%
——20Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.21dCVE-2026-1076076.2 MÉD8.4%
——3SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication.23dCVE-2026-1076066.2 MÉD8.4%
——3SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication.23dCVE-2026-1076056.2 MÉD8.4%
——3SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to view live video feed without authentication.22dCVE-2026-1066257.8 ALT9.7%
——3Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.24dCVE-2026-1057338.8 ALT26.1%
——8Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally.10dCVE-2026-1057327.3 ALT40.3%
——12Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally.24dCVE-2026-1057315.5 MÉD37.8%
——11Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally.24dCVE-2026-1057297.1 ALT30.1%
——9Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.24dCVE-2026-1057287.5 ALT62.7%
——19Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.24dCVE-2026-1057278.8 ALT64.1%
——19Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.24dCVE-2026-1057265.5 MÉD37.8%
——11Out-of-bounds read in Microsoft Defender allows an authorized attacker to disclose information locally.24d