Vulnerabilidades exploráveis hoje
413,655na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,779
Novos KEV · 24H0
Exploit Today ≥ 701,707
Distribuição · última janela
- Crítica5,606
- Alta22,396
- Média20,866
- Baixa2,124
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2021-22122—95.8%
——29——CVE-2025-4524—95.8%
——29——CVE-2008-6904—95.8%
——29——CVE-2006-0749—95.8%
——29——CVE-2026-2085—95.8%
——29——CVE-2015-53468.1 ALT95.8%
——29Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.29dCVE-2026-2184—95.8%
——29——CVE-2025-50979—95.8%
——29——CVE-2012-5277—95.8%
——29——CVE-2013-2131—95.8%
——29——CVE-2012-6499—95.8%
——29——CVE-2019-1225—95.8%
——29——CVE-2015-8327—95.8%
——29——CVE-2012-3796—95.8%
——29——CVE-2007-6325—95.8%
——29——CVE-2021-31558—95.8%
——29——CVE-2019-12528—95.8%
——29——CVE-2018-10630—95.8%
——29——CVE-2006-6811—95.8%
——29——CVE-2021-31682—95.8%
——29——CVE-2021-294254.8 MÉD95.8%
——29In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.36dCVE-2013-4474—95.8%
——29——CVE-2014-0995—95.8%
——29——CVE-1999-0348—95.8%
——29——CVE-2014-1889—95.8%
——29——CVE-2019-9831—95.8%
——29——CVE-2001-0557—95.8%
——29——CVE-2005-4556—95.8%
——29——CVE-2025-32794—95.8%
——29——CVE-2015-6568—95.8%
——29——CVE-2025-595387.5 ALT95.8%
——29Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic. A single unauthenticated HTTP POST is enough to kill the process. This issue is resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.31dCVE-2020-6756—95.8%
——29——CVE-1999-0018—95.8%
——29——CVE-2009-3027—95.8%
——29——CVE-2008-4480—95.8%
——29——CVE-2002-0606—95.8%
——29——CVE-2013-6618—95.8%
——29——CVE-2006-3472—95.8%
——29——CVE-2021-24300—95.8%
——29——CVE-2006-2224—95.8%
——29——