Biblioteca de vulnerabilidades explotadas
Cada fallo de software que se sabe que los atacantes han usado, del catálogo que mantiene desde noviembre de 2021 la Agencia de Ciberseguridad y Seguridad de Infraestructuras de EE. UU. (CISA). Se actualiza cada hora.
- 1.760vulnerabilidades explotadas
- 361usado por ransomware
- 291fabricantes
1.760 vulnerabilidades
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 14 sept 2026 | SQL Injection | Cisco Secure Email Gateway | Crítica 9,8 | 30% |
| 11 sept 2026 | Path Traversal | GitLab Community Edition and Enterprise Edition | Crítica 10,0 | 97% |
| 11 sept 2026 | Improper Privilege Management and Missing Authorization | ConnectWise ScreenConnect | Crítica 9,9 | 0,9% |
| 11 sept 2026 | Improper Authentication | JFrog Artifactory | Alto 7,5 | 9,8% |
| 11 sept 2026 | Incorrect Authorization | JFrog Artifactory | Alto 8,1 | 8,6% |
| 10 sept 2026 | Improper Neutralization of Argument Delimiters in a Command | MikroTik RouterOS | Crítica 9,2 | 6,4% |
| 10 sept 2026 | Missing Authentication for Critical Function | MikroTik RouterOS | Alto 8,8 | 1,6% |
| 9 sept 2026 | Out of Bounds Write | Google Chromium V8 | Alto 8,8 | 3,5% |
| 9 sept 2026 | Firewall Management Center Authentication Bypass Using an Alternate Path or Channel | Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Crítica 10,0 | 88% |
| 9 sept 2026 | Authentication Bypass Using an Alternate Path or Channel | Citrix NetScaler | Crítica 9,3 | 33% |
| 9 sept 2026 | Heap-based Buffer Overflow | Fortinet Multiple Products | Alto 7,4 | 3,7% |
| 8 sept 2026 | Static Code Injection | N-able N-central | Crítica 10,0 | 15% |
| 8 sept 2026 | Heap-Based Buffer Overflow | Microsoft Windows | Alto 7,8 | 0,4% |
| 8 sept 2026 | Link Following | Microsoft Windows | Alto 7,8 | 0,4% |
| 8 sept 2026 | Improper Neutralization of Special Elements Used in a Template Engine | Adobe Commerce and Magento | Crítica 10,0 | 3,9% |
| 4 sept 2026 | Type Confusion | Google Chromium V8 | Alto 8,8 | 1,8% |
| 2 sept 2026 | SQL Injection | Sangoma Switchvox | Crítica 9,3 | 19% |
| 2 sept 2026 | OS Command Injection | SonicWall SMA1000 Appliances | Alto 7,8 | 9,9% |
| 2 sept 2026 | Server-Side Request Forgery | SonicWall SMA1000 Appliances | Crítica 10,0 | 8,0% |
| 2 sept 2026 | Improper Authentication | JFrog Artifactory | Crítica 9,8 | 14% |
| 2 sept 2026 | Improper Authentication | BerriAI LiteLLM | Alto 8,8 | 0,8% |
| 2 sept 2026 | OSS OS Command Injection | Kestra Kestra OSS | Crítica 10,0 | 2,1% |
| 2 sept 2026 | HTTP Request/Response Smuggling | Kludex Starlette | Media 6,5 | 70% |
| 31 ago 2026 | Unsafe Reflection | PaperCut NG/MF | Crítica 9,4 | 61% |
| 31 ago 2026 | Missing Authentication for Critical Function | PaperCut NG/MF | Alto 8,8 | 84% |
| 27 ago 2026 | Improper Limitation of a Pathname to a Restricted Directory | JFrog Artifactory | Media 5,3 | 0,7% |
| 27 ago 2026 | Unspecified | Linux Kernel | Alto 7,8 | 0,7% |
| 27 ago 2026 | Improper Authentication | ownCloud ownCloud | Crítica 9,8 | 43% |
| 26 ago 2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | Citrix NetScaler ADC and NetScaler Gateway | Alto 8,8 | 1,0% |
| 26 ago 2026 | Out-of-Bounds Write | Linux Kernel | Alto 7,8 | 8,9% |
| 26 ago 2026 | Deserialization of Untrusted Data | Ajax.NET Professional Ajax.NET Professional | Alto 8,1 | 83% |
| 26 ago 2026 | Remote Code Execution | Microsoft SQL Server | Alto 8,8 | 57% |
| 26 ago 2026 | Privilege Escalation | Red Hat Automatic Bug Reporting Tool | Alto 7,8 | 5,0% |
| 26 ago 2026 | Race Condition | Red Hat Libuser | Alto 7,4 | 8,5% |
| 25 ago 2026 | Code Injection | Gitea Gitea | Crítica 9,8 | 24% |
| 24 ago 2026 | Improper Access Control | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in | Crítica 10,0 | 73% |
| 21 ago 2026 | OS Command Injection | Synacor Zimbra Collaboration Suite (ZCS) | Alto 8,9 | 72% |
| 20 ago 2026 | Code Injection | TrueConf Server | Crítica 9,5 | 1,7% |
| 20 ago 2026 | Missing Authentication for Critical Function | TrueConf Server | Crítica 9,3 | 1,5% |
| 19 ago 2026 | Server-Side Request Forgery | MLflow MLflow | Crítica 9,3 | 10% |
| 18 ago 2026 | Improper Authentication | Apple macOS | Crítica 9,8 | 1,7% |
| 18 ago 2026 | Path Traversal | Broadcom VMware vCenter | Crítica 9,8 | 2,6% |
| 18 ago 2026 | Weak Authentication | Microsoft SharePoint | Crítica 9,1 | 70% |
| 18 ago 2026 | Double Free | Microsoft Internet Key Exchange (IKE) Service Extensions | Crítica 9,8 | 77% |
| 17 ago 2026 | Code Injection | Ray-Project Ray | Crítica 9,4 | 60% |
| 11 ago 2026 | SQL Injection | Metabase Metabase | Crítica 10,0 | 99% |
| 11 ago 2026 | Windows Ancillary Function Driver for WinSock Use-After-Free | Microsoft Windows Ancillary Function Driver for WinSock | Alto 7,0 | 0,3% |
| 11 ago 2026 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | Alto 8,6 | 1,0% |
| 7 ago 2026 | Command Injection | Progress LoadMaster | Crítica 9,6 | 99,8% |
| 5 ago 2026 | Deserialization of Untrusted Data | JetBrains TeamCity | Crítica 9,8 | 94% |
Fabricantes más atacados
- Microsoft 390
- Cisco 101
- Apple 95
- Adobe 83
- Google 76
- Oracle 46
- Apache 41
- Ivanti 36
- Fortinet 32
- Linux 31
- Citrix 27
- VMware 26
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.