Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2989▼ 73 respecto a la semana anterior

Críticas / altas1415▲ 65 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)382▼ 128 respecto a la semana anterior

5 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2025-59361	Analizada	Crítica (9.8)	3.3%	—	Chaos-mesh Chaos Mesh	15/9/2025	17/6/2026	The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
CVE-2025-59360	Analizada	Crítica (9.8)	2.8%	—	Chaos-mesh Chaos Mesh	15/9/2025	17/6/2026	The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
CVE-2025-59359	Analizada	Crítica (9.8)	2.9%	💥 PoC	Chaos-mesh Chaos Mesh	15/9/2025	17/6/2026	The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
CVE-2025-59358	Analizada	Alta (7.5)	0.78%	—	Chaos-mesh Chaos Mesh	15/9/2025	17/6/2026	The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.
CVE-2024-36538	Analizada	Alta (8.8)	0.57%	—	Chaos-mesh Chaos Mesh	24/7/2024	17/6/2026	Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.