Vulnerabilidades exploráveis hoje
413,805na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,779
Novos KEV · 24H0
Exploit Today ≥ 701,707
Distribuição · última janela
- Crítica5,615
- Alta22,524
- Média20,884
- Baixa2,135
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2009-2193—95.5%
——29——CVE-2018-3964—95.5%
——29——CVE-2000-0883—95.5%
——29——CVE-2022-32275—95.5%
——29——CVE-2002-0068—95.5%
——29——CVE-2002-2311—95.5%
——29——CVE-2006-3192—95.5%
——29——CVE-2016-2087—95.5%
——29——CVE-2002-2015—95.5%
——29——CVE-2024-300877.8 ALT95.5%
——29Win32k Elevation of Privilege Vulnerability115dCVE-2010-3676—95.5%
——29——CVE-2020-11527—95.5%
——29——CVE-2013-1299—95.5%
——29——CVE-2015-6490—95.5%
——29——CVE-2026-2527—95.5%
——29——CVE-2019-17626—95.5%
——29——CVE-2013-45904.3 SEM95.5%
——29Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.34dCVE-2010-1475—95.5%
——29——CVE-2023-6304—95.5%
——29——CVE-2005-0838—95.5%
——29——CVE-2019-0802—95.5%
——29——CVE-2007-3383—95.5%
——29——CVE-2007-2456—95.5%
——29——CVE-2010-1474—95.5%
——29——CVE-2015-7259—95.5%
——29——CVE-2007-3026—95.5%
——29——CVE-2004-0888—95.5%
——29——CVE-2020-25858—95.5%
——29——CVE-2017-3059—95.5%
——29——CVE-2025-599349.4 CRÍ95.5%
——29Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a token validation routine that only decodes JWTs (jwt.decode) without verifying their signatures. Both the email verification token login path and the password reset server action use the same validator, which does not check the token’s signature, expiration, issuer, or audience. If an attacker learns the victim’s actual user.id, they can craft an arbitrary JWT with an alg: "none" header and use it to authenticate and reset the victim’s password. This issue has been patched in version 4.0.1.24dCVE-2015-2544—95.5%
——29——CVE-2017-7041—95.5%
——29——CVE-2010-4180—95.5%
——29——CVE-2008-3681—95.5%
——29——CVE-2002-1178—95.5%
——29——CVE-2019-7804—95.5%
——29——CVE-2015-6170—95.5%
——29——CVE-1999-0926—95.5%
——29——CVE-2011-1470—95.5%
——29——CVE-2017-14064—95.5%
——29——