Vulnerabilidades exploráveis hoje
17,438na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,768
Novos KEV · 24H0
Exploit Today ≥ 701,700
Distribuição · última janela
- Crítica5,799
- Alta22,636
- Média22,025
- Baixa2,187
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1223265.3 MÉD—
——0Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any public page and an album's encoded id can obtain image filenames, viewer and direct file URLs, and download private images.7hCVE-2026-1223253.1 BAI—
——0fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled can submit another event's pseudonymization id or order secret while naming that organizer in the URL to retrieve attendee names, emails, addresses and answers.12hCVE-2026-1223243.1 BAI—
——0SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUID, such as removed former participants, can retrieve expense notes, recurrence schedules, and full user rows of participants and group members.12hCVE-2026-1223174.3 MÉD—
——0SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers.12hCVE-2026-1211397.8 ALT—
——0The Rapid7 Metasploit msf-ws suffers from a missing authentication vulnerability whereby the REST API grants an unauthenticated "bootstrap" exemption so that the very first administrator can be created when the users table is empty. While the table is empty, POST /api/v1/users is exempt from authentication by design: the route handler calls warden.authenticate!(scope: :admin_api), which resolves to AdminApiToken. The inherited ApiToken#authenticate! short-circuits and returns success!() whenever msf.auth_initialized is false, without ever evaluating AdminApiToken's administrator check. In that state the endpoint creates a user — including an administrator — for an entirely unauthenticated caller.
This issue has been fixed in version 6.5.9.11hCVE-2026-1197515.3 MÉD—
——0Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permission_check() improperly returns true when no X-WP-Nonce header is supplied. Attackers can supply the post_id and module id of a draft, pending, scheduled, or private post to handle_render(), which lacks a publish-status check, to disclose product titles, destination and affiliate URLs, merchant or domain information, and descriptions.7hCVE-2026-119345——
——0Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, configuration, or attached devices after that check can keep the existing connection open while the peer continues trusting stale initial Evidence. This gap is especially significant for long-lived connections because the verifier has no mechanism to detect the changed state. This issue is fixed in version 0.9.0.7hCVE-2026-119344——
——0Cocos AI is a confidential computing system for AI. In version 0.8.2 and earlier, Cocos AI accepts trusted execution environment attestation Evidence when firmware patch levels and software measurements match, without binding the Evidence to an allowed platform owner or unique machine identity and without enforcing revocation. A remote attacker who controls or compromises another platform trusted by the same verifier can substitute valid Evidence from that platform and cause authorization of the wrong platform. This vulnerability is addressed in 0.9.0. However, this vulnerability can't be patched in source code alone, since the vulnerability arises from the confidential computing threat model itself.12hCVE-2026-1157404.3 MÉD—
——0Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix parameter in the OpenEventEvidenceFile.do endpoint accepts arbitrary UNC paths without validation. The server-side code attempts to open the specified file path, causing Windows to resolve the hostname and initiate SMB authentication to the attacker-controlled host.11hCVE-2026-1157396.5 MÉD—
——0Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials and evidence files.9hCVE-2026-1078918.1 ALT—
——0musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.11hCVE-2026-1042698.6 ALT—
——0ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection. PHP's native multipart parser is not affected by this discrepancy. This issue is fixed in version 3.0.17.12hCVE-2026-1039325.8 MÉD—
——0ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17.12hCVE-2026-1026157.6 ALT—
——0HeyForm is an open-source form builder. Prior to 3.0.1, /api/upload accepts a file according to the client-controlled multipart file.mimetype while retaining an HTML filename, and static/upload serves the resulting file as text/html with contentSecurityPolicy: false. An ordinary user can therefore upload active HTML that executes on the HeyForm origin when a victim opens its returned URL. The same-origin script can access /graphql with the victim's session and read or modify data available to that account. The code also permits upload requests tied to an active public form through formId, openToken, and a fieldId belonging to a file or signature question, although the advisory did not fully verify that unauthenticated path end to end. This issue is fixed in version 3.0.1.12hCVE-2026-1025238.0 ALT—
——0MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.7hCVE-2023-51466——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-51465——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-47089——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-47088——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-47087——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-47086——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-47085——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-47084——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-47083——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-47082——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-47045——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-44370——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-44369——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-44368——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-44364——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-44363——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-44354——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-44349——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-38202——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-29493——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-26399——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-26365——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-26363——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-26362——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512hCVE-2023-26357——
——0Rejected reason: Reserved ID never published and not linked to any VULN ticket - quota reclaim 2026-11-0512h