Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2952▲ 10 respecto a la semana anterior
Críticas / altas1451▲ 185 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior
Sin puntuar (sin CVSS)272▼ 254 respecto a la semana anterior
14 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Analizada | Media (6.1) | 0.25% | — | Auntvt Timo | 26/3/2026 | 17/6/2026 | Cross Site Scripting (xss) vulnerability in Timo 2.0.3 via crafted links in the title field. | |
| Aplazada | Crítica (9.3) | 4.1% | — | Shenzhen TVT Digital Technology Nvms-9000AI | 24/11/2025 | 17/6/2026 | Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains hardcoded API credentials and an OS command injection flaw in its configuration services. The web/API interface accepts HTTP/XML requests authenticated with a fixed vendor credential string and… | |
| Aplazada | Alta (8.7) | 0.86% | — | Shenzhen TVT Digital Technology Nvms-9000AI | 24/11/2025 | 26/9/2026 | Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) versions prior to 1.3.4 contain an authentication bypass in the NVMS-9000 control protocol. By sending a single crafted TCP payload to an exposed NVMS-9000 control port, an unauthenticated remote attacker can… | |
| Modificada | Crítica (10) | 31% | — | TVT Td-2108ts-cl FirmwareTVT Td-2108ts-cl-a FirmwareTVT Td-2116ts-cl FirmwareTVT Td-2104ts-hc Firmware+26 | 24/6/2025 | 17/6/2026 | An OS command injection vulnerability exists in white-labeled DVRs manufactured by TVT, affecting a custom HTTP service called "Cross Web Server" that listens on TCP ports 81 and 82. The web interface fails to sanitize input in the URI path passed to the language extraction functionality. When the server processes a… | |
| Aplazada | Alta (7.3) | 0.43% | — | Auntvt TimoAI | 10/2/2025 | 17/6/2026 | An arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows attackers to execute arbitrary code via uploading a crafted file. | |
| Analizada | Media (6.9) | 32% | — | Provision-isr Sh-4050a5-5l(mm) FirmwareTVT Avision Av108t FirmwareTVT Td-2104ts-cl FirmwareTVT Td-2108ts-hp Firmware | 1/8/2024 | 17/6/2026 | A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM) and AVISION DVR AV108T and classified as problematic. This vulnerability affects unknown code of the file /queryDevInfo. The manipulation leads to information disclosure. The attack can be initiated remotely.… | |
| Analizada | Crítica (9.8) | 1.1% | — | Auntvt Timo | 20/2/2024 | 17/6/2026 | An issue in Timo v.2.0.3 allows a remote attacker to execute arbitrary code via the filetype restrictions in the UploadController.java component. | |
| Analizada | Alta (7.5) | 96% | ⚠ Explotación activa | TVT Nvms-1000 Firmware | 30/12/2019 | 17/6/2026 | TVT NVMS-1000 devices allow GET /.. Directory Traversal | |
| Modificada | Alta (7.8) | 10% | — | TVT DVRTVT DVR Firmware | 2/11/2013 | 16/6/2026 | Directory traversal vulnerability in the TVT TD-2308SS-B DVR with firmware 3.2.0.P-3520A-00 and earlier allows remote attackers to read arbitrary files via .. (dot dot) in the URI. | |
| Modificada | Alta (7.2) | 0.35% | — | SAM Lantinga Splitvt | 22/2/2008 | 16/6/2026 | misc.c in splitvt 1.6.6 and earlier does not drop group privileges before executing xprop, which allows local users to gain privileges. | |
| Modificada | Alta (7.2) | 1.3% | — | SAM Lantinga SplitvtDebian Linux | 12/3/2001 | 16/6/2026 | Format string vulnerability in splitvt before 1.6.5 allows local users to execute arbitrary commands via the -rcfile command line argument. | |
| Modificada | Alta (7.2) | 1.2% | — | SAM Lantinga SplitvtDebian Linux | 12/3/2001 | 16/6/2026 | Multiple buffer overflows in splitvt before 1.6.5 allow local users to execute arbitrary commands. | |
| Modificada | Alta (7.2) | 1.1% | — | SAM Lantinga Splitvt | 1/6/2000 | 16/6/2026 | Buffer overflow in Linux splitvt 1.6.3 and earlier allows local users to gain root privileges via a long password in the screen locking function. | |
| Modificada | Alta (7.2) | 0.41% | — | SAM Lantinga Splitvt | 1/12/1995 | 16/6/2026 | Buffer overflow in Linux splitvt command gives root access to local users. |