Vulnerabilidades exploráveis hoje
413,805na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,779
Novos KEV · 24H0
Exploit Today ≥ 701,707
Distribuição · última janela
- Crítica5,615
- Alta22,524
- Média20,884
- Baixa2,135
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2022-32275—95.5%
——29——CVE-2010-3676—95.5%
——29——CVE-2009-0955—95.5%
——29——CVE-1999-0266—95.5%
——29——CVE-2012-6663—95.5%
——29——CVE-2012-6151—95.5%
——29——CVE-2007-1542—95.5%
——29——CVE-2015-6490—95.5%
——29——CVE-2015-4335—95.5%
——29——CVE-2007-4586—95.5%
——29——CVE-2019-7822—95.5%
——29——CVE-2020-8868—95.5%
——29——CVE-2007-2390—95.5%
——29——CVE-2017-20212—95.5%
——29——CVE-2010-2119—95.5%
——29——CVE-2025-49189.8 CRÍ95.5%
——29An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2.43dCVE-2019-17626—95.5%
——29——CVE-2013-0504—95.5%
——29——CVE-2018-71608.8 ALT95.5%
——29The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.35dCVE-2007-2593—95.5%
——29——CVE-2017-3059—95.5%
——29——CVE-2019-19649—95.5%
——29——CVE-2009-0255—95.5%
——29——CVE-2013-45904.3 SEM95.5%
——29Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.34dCVE-2020-11527—95.5%
——29——CVE-2000-0011—95.5%
——29——CVE-2000-0202—95.5%
——29——CVE-2013-1299—95.5%
——29——CVE-2005-3934—95.5%
——29——CVE-2019-0802—95.5%
——29——CVE-2002-0068—95.5%
——29——CVE-2023-6304—95.5%
——29——CVE-2019-7804—95.5%
——29——CVE-2019-7825—95.5%
——29——CVE-2015-2544—95.5%
——29——CVE-2010-1722—95.5%
——29——CVE-2004-0888—95.5%
——29——CVE-2010-4180—95.5%
——29——CVE-2025-599349.4 CRÍ95.5%
——29Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verification. This vulnerability stems from a token validation routine that only decodes JWTs (jwt.decode) without verifying their signatures. Both the email verification token login path and the password reset server action use the same validator, which does not check the token’s signature, expiration, issuer, or audience. If an attacker learns the victim’s actual user.id, they can craft an arbitrary JWT with an alg: "none" header and use it to authenticate and reset the victim’s password. This issue has been patched in version 4.0.1.24dCVE-2000-0639—95.5%
——29——