Media
CVE-2026-54164
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 402
Restablecer filtros
Alta
CVE-2026-69246
Guzzle: Noncanonical host can bypass host-based checks
Media
CVE-2026-68501
Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII
Media
CVE-2026-52837
Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page
Alta
CVE-2026-55651
Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure
Alta
CVE-2026-59933
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
Alta
CVE-2026-59932
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
Media
CVE-2026-59882
guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
Media
CVE-2026-59883
Guzzle: Cookie Disclosure and Injection via IP-Address Domains
Media
CVE-2026-67339
Guzzle: Proxy-Authorization headers can be sent to origin servers
Crítica
CVE-2026-55579
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
Media
CVE-2026-52883
MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
Media
CVE-2026-54494
Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
Alta
CVE-2026-54491
Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths
Alta
CVE-2026-47142
MantisBT: SQL Injection via history_order Configuration Value
Crítica
CVE-2026-45262
FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`
Media
CVE-2026-52823
Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes
Media
CVE-2026-52822
Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation
Media
CVE-2026-52820
Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass
Alta
CVE-2026-55372
NukeViet: Pre-authentication SSRF via X-Forwarded-Host
Media
CVE-2026-49865
Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs
Media
CVE-2026-49858
API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate
Media
CVE-2026-53638
Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint
Crítica
CVE-2026-52778
YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.