Alta
CVE-2026-47110
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 1.216
Restablecer filtros
Sin evaluar
CVE-2026-13233
drupal/ai_provider_openai - SA-CONTRIB-2026-053
Media
CVE-2026-60092
AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel
Alta
CVE-2026-55173
AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink
Media
CVE-2026-44583
Paymenter has Blind Unauthenticated SSRF on the Paypal gateway module
Alta
CVE-2026-33692
AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration
Crítica
CVE-2025-58048
Paymenter vulnerable to Remote Code Execution via public file uploads
Crítica
CVE-2026-55791
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
Baja
CVE-2026-49215
symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted
Baja
CVE-2026-49212
symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding
Baja
CVE-2026-49209
symfony/ux-live-component: Denial of service via unbounded batch action requests
Media
CVE-2026-55766
guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
Media
CVE-2026-55375
canto-saas-api: OAuth credentials exposed in URL query string and exception messages
Alta
ghsa-3prj-6hqw-cm82
PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service
Crítica
CVE-2026-54003
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
Alta
CVE-2026-54002
Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
Media
CVE-2026-50188
Kirby: Request header injection in `Http\Remote`
Media
CVE-2026-55890
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
Media
CVE-2026-55885
Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets
Sin evaluar
CVE-2026-55808
Drupal core - SA-CORE-2026-009
Sin evaluar
CVE-2026-55807
Drupal core - SA-CORE-2026-008
Media
ghsa-crmm-hgp2-wgrp
Laravel Framework: Temporary Signed URL Path Confusion
Alta
CVE-2026-48019
Laravel Framework: CRLF injection in default email rule
Media
CVE-2026-55599
phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.