Media
CVE-2026-100854
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 1.216
Restablecer filtros
Alta
CVE-2026-42606
AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass
Alta
CVE-2026-42605
AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload
Media
CVE-2026-41890
CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess
Media
CVE-2026-42051
Kirby CMS's system API endpoint leaks installed version and license data to authenticated users
Alta
CVE-2026-29199
phpBB has Password Reset Link Poisoning via Host Header injection
Media
CVE-2026-41671
Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation
Alta
CVE-2026-41670
Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest
Baja
CVE-2026-41663
Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send
Media
CVE-2026-41661
Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion
Alta
CVE-2026-41660
Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP
Baja
CVE-2026-41659
Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment
Media
CVE-2026-41656
Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read
Media
CVE-2026-41655
Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials
Alta
CVE-2026-41587
CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution
Alta
CVE-2026-40863
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
Crítica
CVE-2026-34084
PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
Alta
CVE-2026-38991
Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type
Media
CVE-2026-35453
PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer
Media
CVE-2026-6982
ShowDoc has an Injection vulnerability
Alta
CVE-2026-34587
Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
Media
CVE-2026-41887
Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
Crítica
CVE-2026-41203
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
Crítica
CVE-2026-41202
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.