Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2860▼ 165 respecto a la semana anterior

Críticas / altas1382▲ 50 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)272▼ 254 respecto a la semana anterior

10 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2025-0131	Aplazada	Alta (7.1)	0.15%	—	Opswat Metadefender Endpoint Security SDK^AI Paloaltonetworks Globalprotect^AI	14/5/2025	17/6/2026	An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the…
CVE-2024-52925	Aplazada	Media (6.8)	0.32%	—	Opswat Metadefender Kiosk^AI	26/2/2025	17/6/2026	In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code execution can be performed by an attacker via the MD Kiosk Unlock Device feature for software encrypted USB drives.
CVE-2023-25364	Aplazada	Media (6.1)	0.31%	—	Opswat Metadefender Core^AI	27/3/2024	17/6/2026	Opswat Metadefender Core before 5.2.1 does not properly defend against potential HTML injection and XSS attacks.
CVE-2023-36659	Modificada	Crítica (9.8)	0.98%	—	Opswat Metadefender Kiosk	15/9/2023	17/6/2026	An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Long inputs were not properly processed, which allows remote attackers to cause a denial of service (loss of communication).
CVE-2023-36657	Modificada	Crítica (9.8)	0.69%	—	Opswat Metadefender Kiosk	15/9/2023	17/6/2026	An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows (desktop shortcuts, narrator) can be abused for privilege escalation.
CVE-2023-36658	Modificada	Alta (7.8)	0.23%	—	Opswat Media Validation Agent Opswat Metadefender Kiosk	15/9/2023	17/6/2026	An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. It has an unquoted service path that can be abused locally.
CVE-2022-40778	Modificada	Media (5.4)	0.47%	—	Opswat Metadefender	19/9/2022	17/6/2026	A stored Cross-Site Scripting (XSS) vulnerability in OPSWAT MetaDefender ICAP Server before 4.13.0 allows attackers to execute arbitrary JavaScript or HTML because of the blocked page response.
CVE-2022-32272	Modificada	Crítica (9.8)	9.6%	—	Opswat Metadefender	9/6/2022	17/6/2026	OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect access control, resulting in privilege escalation.
CVE-2022-32273	Modificada	Media (4.3)	0.78%	—	Opswat Metadefender	8/6/2022	17/6/2026	As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could allow an authenticated user to enumerate filenames on the server.
CVE-2018-16275	Modificada	Alta (7.8)	0.95%	—	Opswat Metadefender	31/8/2018	17/6/2026	OPSWAT MetaDefender before v4.11.2 allows CSV injection.