Media
CVE-2026-107380
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 1.216
Restablecer filtros
Media
CVE-2026-107381
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
Alta
CVE-2026-104890
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution
Alta
CVE-2026-105830
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
Baja
CVE-2026-57232
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
Alta
CVE-2026-56737
phpMyFAQ's two-factor authentication login bypasses the password factor
Alta
CVE-2026-56736
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
Alta
CVE-2026-63498
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
Alta
CVE-2026-76086
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
Sin evaluar
CVE-2026-96376
drupal/cloud - SA-CONTRIB-2026-177
Sin evaluar
CVE-2026-96357
drupal/webform - SA-CONTRIB-2026-172
Sin evaluar
CVE-2026-96370
drupal/webform - SA-CONTRIB-2026-164
Sin evaluar
CVE-2026-96362
drupal/webform - SA-CONTRIB-2026-160
Media
CVE-2026-73858
Solspace Freeform: Limited Twig template injection via submitted field values
Media
CVE-2026-88974
WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost
Media
CVE-2026-63000
REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
Media
CVE-2026-63002
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
Media
CVE-2026-71537
Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)
Media
CVE-2026-77607
Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS
Alta
CVE-2025-61682
Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes
Alta
CVE-2026-72819
Grav CMS vulnerable to remote code execution via .zip file upload
Alta
CVE-2026-75837
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
Media
CVE-2026-75834
Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate
Crítica
CVE-2026-75827
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.