CVEs bomba-relógio

Estas vulnerabilidades têm exploit pronto e alta probabilidade de exploração — mas ainda não entraram na lista de exploração ativa. É a janela de tempo para corrigir antes que o ataque aconteça.

Por que “bomba-relógio”?EPSS alto (probabilidade de exploração) + exploit público disponível + ainda fora do KEV (não confirmada como ativa). A combinação que costuma preceder ataques reais.

3914 vulnerabilidades neste estado agora

CVE-2021-45105PoC

Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

◆ VulnCheck KEV

CVE-2014-3566metasploit

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man

CVE-2014-0195metasploit

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properl

CVE-2014-3704PoCnucleimetasploit

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements,

◆ VulnCheck KEV

CVE-2015-7297PoCnucleimetasploit

SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a

CVE-2022-42889PoCmetasploit

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

◆ VulnCheck KEV

CVE-2025-53771nucleimetasploit

Microsoft SharePoint Server Spoofing Vulnerability

◆ VulnCheck KEV

CVE-2026-10520PoCnuclei

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user

◆ VulnCheck KEVSentry

CVE-2015-4000metasploit

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_E

CVE-2020-13379PoCnuclei

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated

◆ VulnCheck KEV

CVE-2017-12635PoCnucleimetasploit

Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x b

◆ VulnCheck KEV

CVE-2017-8917PoCnucleimetasploit

SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2022-39952PoCnucleimetasploit

A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11,

◆ VulnCheck KEV

CVE-2008-2938PoCmetasploit

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking a

CVE-2020-10220PoCnucleimetasploit

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parame

CVE-2019-0232PoCnucleimetasploit

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0

◆ VulnCheck KEVApache Tomcat

CVE-2023-27372PoCnucleimetasploit

SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions ar

◆ VulnCheck KEV

CVE-2022-37061PoCnucleimetasploit

All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to

◆ VulnCheck KEV

CVE-2020-14181PoCnucleimetasploit

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vu

CVE-2020-16040PoCmetasploit

Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption v

◆ VulnCheck KEV

CVE-2022-1471metasploit

Remote Code execution in SnakeYAML

CVE-2014-0094PoCmetasploit

The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter,

◆ VulnCheck KEV

CVE-2025-1974PoCnuclei

ingress-nginx admission controller RCE escalation

CVE-2024-6387PoC

Openssh: regresshion - race condition in ssh allows rce/dos

◆ VulnCheck KEV

CVE-2017-1000028PoCnucleimetasploit

Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability,

◆ VulnCheck KEV

CVE-2013-0156PoCmetasploit

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.1

◆ VulnCheck KEV

CVE-2023-37679nucleimetasploit

A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting

◆ VulnCheck KEV

CVE-2023-32560PoCmetasploit

An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary co

CVE-2021-34429PoCnucleimetasploit

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the con

◆ VulnCheck KEV

CVE-2017-12542PoCnucleimetasploit

A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53 was found.

◆ VulnCheck KEV

CVE-2018-12998nuclei

A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manage

◆ VulnCheck KEV

CVE-2023-23333PoCnucleimetasploit

There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restricti

◆ VulnCheck KEV

CVE-2025-29927PoCnucleimetasploit

Authorization Bypass in Next.js Middleware

◆ VulnCheck KEVNext.js

CVE-2026-48282PoCnuclei

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

◆ VulnCheck KEV

CVE-2020-36289nuclei

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vu

CVE-2021-25646PoCnucleimetasploit

Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.

◆ VulnCheck KEV

CVE-2023-34960PoCnucleimetasploit

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary comm

◆ VulnCheck KEV

CVE-2015-1538PoC

Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I all

CVE-2022-24637PoCnucleimetasploit

Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to g

CVE-2020-11022PoC

jQuery has a potential XSS vulnerability

◆ VulnCheck KEVjQuery