Alta
CVE-2026-52775
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 402
Restablecer filtros
Alta
CVE-2026-52771
YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)
Alta
CVE-2026-52769
YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`
Alta
CVE-2026-53932
laravel-backup-restore has an OS Command Injection during database restore
Sin evaluar
CVE-2026-15082
drupal/siteimprove_analytics - SA-CONTRIB-2026-073
Crítica
CVE-2026-9559
Mautic vulnerable to Path Traversal via Campaign Import
Alta
CVE-2026-50279
Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
Baja
CVE-2026-49358
PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles
Alta
CVE-2026-49286
PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
Alta
CVE-2026-49260
php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)
Alta
CVE-2026-56396
phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards
Alta
CVE-2026-48979
PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling
Baja
CVE-2026-48488
phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing
Media
CVE-2026-33731
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data
Crítica
CVE-2025-58048
Paymenter vulnerable to Remote Code Execution via public file uploads
Alta
CVE-2026-55692
StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled
Crítica
CVE-2026-55791
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
Media
CVE-2026-55375
canto-saas-api: OAuth credentials exposed in URL query string and exception messages
Media
CVE-2026-55374
canto-saas-api: Authenticated API requests can be redirected via unencoded path variables
Alta
ghsa-jc38-x7x8-2xc8
PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks
Media
CVE-2026-50188
Kirby: Request header injection in `Http\Remote`
Media
CVE-2026-55890
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
Media
CVE-2026-55885
Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets
Media
CVE-2026-48736
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.