Conoce las vulnerabilidades. Protege tus aplicaciones.

Baja 09.10.2026

CVE-2026-107848

Contao: Falsificación de petición en sitios cruzados en acciones personalizadas del backend

Una vulnerabilidad de falsificación de petición en sitios cruzados en Contao permite ejecutar acciones destructivas o de cambio de estado en el backend si un usuario autenticado accede a una URL manipulada.

Composer

contao/core-bundle

Alta 24.09.2026

CVE-2026-63498

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Composer

snipe/snipe-it

Media 16.09.2026

CVE-2026-61453

Grav: XSS Blueprint Validation Bypass via Twig String Concatenation

Composer

getgrav/grav

Media 31.08.2026

CVE-2026-15305

TYPO3 CMS - Unrestricted File Upload in Form Framework

Composer

typo3/cms-form

Media 28.08.2026

CVE-2026-55466

Snipe-IT vulnerable to stored XSS via inline-served attachment

Composer

snipe/snipe-it

Media 20.08.2026

CVE-2026-79773

Winter: Local File Inclusion through =include directives in JavaScript asset compilation

Composer

winter/wn-system-module

Media 20.08.2026

CVE-2026-63179

Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

Composer

winter/wn-backend-module

Alta 20.08.2026

CVE-2026-54175

Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

Composer

backpack/crud

Crítica 07.08.2026

CVE-2026-72780

Craft CMS: Passkey login accepts replayed WebAuthn assertions

Composer

craftcms/cms

Alta 06.08.2026

CVE-2026-72786

Craft CMS: Arbitrary user password reset leading to administrator account takeover

Composer

craftcms/cms

Alta 31.07.2026

CVE-2026-53599

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

Composer

redaxo/source

Alta 24.07.2026

ghsa-rm67-g9ch-vxff

Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

Composer

poweradmin/poweradmin

Media 22.07.2026

CVE-2026-56722

Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Composer

dompdf/dompdf

Alta 15.07.2026

CVE-2026-54491

Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths

Composer

phanan/koel

Alta 15.07.2026

CVE-2026-54493

Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

Composer

phanan/koel

Media 15.07.2026

CVE-2026-54492

Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Composer

phanan/koel

Crítica 14.07.2026

CVE-2026-45262

FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

Composer

facturascripts/facturascripts

Media 13.07.2026

CVE-2026-52820

Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

Composer

kimai/kimai

Media 09.07.2026

CVE-2026-53638

Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint

Composer

sylius/sylius

Alta 02.07.2026

CVE-2026-49283

SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

Composer

simplesamlphp/saml2, simplesamlphp/saml2-legacy

Alta 26.06.2026

CVE-2026-49260

php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

Composer

pontedilana/php-weasyprint

Baja 19.06.2026

CVE-2026-49209

symfony/ux-live-component: Denial of service via unbounded batch action requests

Composer

symfony/ux-live-component

Media 04.06.2026

CVE-2026-48013

Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Composer

shopware/core, shopware/platform

Media 04.06.2026

CVE-2026-48016

Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment

Composer

shopware/core, shopware/platform