Vulnerabilidades exploráveis hoje
414,772na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,781
Novos KEV · 24H0
Exploit Today ≥ 701,709
Distribuição · última janela
- Crítica5,285
- Alta20,849
- Média19,529
- Baixa2,047
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2001-1209—94.9%
——28——CVE-2018-16618—94.9%
——28——CVE-2018-17899—94.9%
——28——CVE-2026-82276.3 MÉD94.9%
——28A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manipulation causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.114dCVE-2017-14117—94.9%
——28——CVE-2008-2654—94.9%
——28——CVE-2018-4946—94.8%
——28——CVE-2007-5198—94.9%
——28——CVE-2008-1888—94.9%
——28——CVE-2018-7316—94.9%
——28——CVE-2008-5062—94.9%
——28——CVE-2026-82306.3 MÉD94.9%
——28A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function sys_login1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.114dCVE-2013-1638—94.9%
——28——CVE-2017-7056—94.9%
——28——CVE-2025-5695—94.9%
——28——CVE-2019-108698.1 ALT94.9%
——28Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.89dCVE-2016-5421—94.9%
——28——CVE-2006-2330—94.9%
——28——CVE-2021-38699—94.9%
——28——CVE-2007-4672—94.9%
——28——CVE-2007-2429—94.9%
——28——CVE-2020-35498—94.9%
——28——CVE-2016-67977.5 ALT94.9%
——28The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.37dCVE-2017-11813—94.9%
——28——CVE-2020-28037—94.9%
——28——CVE-2017-1000367—94.9%
——28——CVE-1999-1069—94.9%
——28——CVE-2022-29361—94.9%
——28——CVE-2018-5059—94.8%
——28——CVE-2004-2519—94.9%
——28——CVE-2013-2154—94.9%
——28——CVE-2020-9495—94.9%
——28——CVE-2018-7124—94.9%
——28——CVE-2008-0763—94.9%
——28——CVE-2008-5856—94.9%
——28——CVE-2020-4415—94.9%
——28——CVE-2019-199067.5 ALT94.9%
——28cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.32dCVE-2004-2132—94.9%
——28——CVE-2020-17510—94.9%
——28——CVE-2018-8002—94.9%
——28——