Vulnerabilidades exploráveis hoje
413,805na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,779
Novos KEV · 24H0
Exploit Today ≥ 701,707
Distribuição · última janela
- Crítica5,618
- Alta22,538
- Média20,938
- Baixa2,137
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2013-1537—95.6%
——29——CVE-2009-5135—95.6%
——29——CVE-2015-3065—95.6%
——29——CVE-2005-0523—95.6%
——29——CVE-2017-2926—95.6%
——29——CVE-2015-1930—95.6%
——29——CVE-2001-1287—95.6%
——29——CVE-2025-50404—95.6%
——29——CVE-2002-1057—95.6%
——29——CVE-2008-2468—95.6%
——29——CVE-1999-0490—95.6%
——29——CVE-2008-5120—95.6%
——29——CVE-2020-16915—95.6%
——29——CVE-2023-27100—95.6%
——29——CVE-2017-2962—95.6%
——29——CVE-2015-6668—95.6%
——29——CVE-2019-11705—95.6%
——29——CVE-2000-0527—95.6%
——29——CVE-2021-40960—95.6%
——29——CVE-2016-5699—95.6%
——29——CVE-2007-3164—95.6%
——29——CVE-2011-0598—95.6%
——29——CVE-2006-4913—95.6%
——29——CVE-2019-1335—95.6%
——29——CVE-2023-46260—95.6%
——29——CVE-2005-0689—95.6%
——29——CVE-2012-4988—95.6%
——29——CVE-2004-1666—95.6%
——29——CVE-2004-0613—95.6%
——29——CVE-2001-1343—95.6%
——29——CVE-2019-8390—95.6%
——29——CVE-2022-0948—95.6%
——29——CVE-2015-1126—95.6%
——29——CVE-2026-62799.8 CRÍ95.6%
——29The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the `wp_conditional_tags` case in `Fusion_Builder_Conditional_Render_Helper::get_value()` passing attacker-controlled values from a base64-decoded JSON blob directly to `call_user_func()` without any allowlist validation. This is exploitable by unauthenticated attackers through the `fusion_get_widget_markup` AJAX endpoint, which is registered for non-privileged (unauthenticated) users via `wp_ajax_nopriv_fusion_get_widget_markup`. The endpoint is protected only by a nonce (`fusion_load_nonce`), but this nonce is generated for user ID 0 and is deterministically exposed in the JavaScript output of any public-facing page containing a Post Cards (`[fusion_post_cards]`) or Table of Contents (`[fusion_table_of_contents]`) element. This makes it possible for unauthenticated attackers to execute arbitrary code on affected sites.112dCVE-2014-0521—95.6%
——29——CVE-2017-14746—95.6%
——29——CVE-2021-306406.5 MÉD95.6%
——29A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.35dCVE-2019-16294—95.6%
——29——CVE-2022-27793—95.6%
——29——CVE-2016-4092—95.6%
——29——