Vulnerabilidades exploráveis hoje
409,857na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,769
Novos KEV · 24H0
Exploit Today ≥ 701,700
Distribuição · última janela
- Crítica5,527
- Alta21,044
- Média20,197
- Baixa2,086
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2023-23333—99.9%
——30——CVE-2012-1430—99.9%
——30——CVE-2023-38646—99.9%
——30——CVE-2022-40300—99.9%
——30——CVE-2018-12998—99.9%
——30——CVE-2017-12542—99.9%
——30——CVE-2020-16040—99.9%
——30——CVE-2020-110226.9 MÉD99.9%
——30In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.5dCVE-2014-01147.5 SEM99.9%
——30Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.24dCVE-2012-1431—99.9%
——30——CVE-2021-25646—99.9%
——30——CVE-2022-37061—99.9%
——30——CVE-2009-1122—99.9%
——30——CVE-2020-7209—99.9%
——30——CVE-2015-1538—99.9%
——30——CVE-2018-12613—99.9%
——30——CVE-2023-32560—99.9%
——30——CVE-2020-36289—99.9%
——30——CVE-2012-1442—99.9%
——30——CVE-2023-349609.8 CRÍ99.9%
——30A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.122dCVE-2019-5736—99.9%
——30——CVE-2018-15473—99.9%
——30——CVE-2025-29927—99.9%
——30——CVE-2022-24637—99.9%
——30——CVE-2013-47867.5 ALT99.9%
——30The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.29dCVE-2022-39986—99.9%
——30——CVE-2019-11477—99.9%
——30——CVE-2023-28341—99.9%
——30——CVE-2015-02044.3 SEM99.9%
——30The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations.24dCVE-2024-63878.1 ALT99.9%
——30A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.1dCVE-2019-1003000—99.9%
——30——CVE-2013-0156—99.9%
——30——CVE-2021-34429—99.9%
——30——CVE-2020-9496—99.9%
——30——CVE-2018-19276—99.9%
——30——CVE-2017-1000028—99.9%
——30——CVE-2022-1471—99.9%
——30——CVE-2003-0352—99.9%
——30——CVE-2024-29895—99.9%
——30——CVE-2018-15745—99.9%
——30——