Alta
CVE-2026-44738
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 388
Restablecer filtros
Alta
CVE-2026-39850
Yii 2: Local file inclusion via view parameter name collision
Alta
CVE-2026-44832
Snipe-IT has Privilege Escalation via API Permissions Assignment
Media
CVE-2026-44298
Kimai has an arbitrary file read in its invoice PDF renderer (admin)
Media
CVE-2026-36341
Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint
Alta
CVE-2026-42845
Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override
Alta
CVE-2026-42550
Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
Media
CVE-2026-45008
phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins
Alta
CVE-2026-46366
phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query
Alta
CVE-2026-46359
phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields
Media
CVE-2026-46360
phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS
Media
CVE-2026-80198
Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/export templates
Media
CVE-2026-80202
Kimai has Missing Voter Check that Allows Cross-Team Timesheet Manipulation
Media
CVE-2026-43882
AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing
Media
CVE-2026-43881
AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction
Media
CVE-2026-43880
AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address
Alta
CVE-2026-42611
Grav is Vulnerable to Stored XSS via Tag Injection
Crítica
CVE-2026-56700
Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass
Crítica
CVE-2026-42613
Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access
Media
CVE-2026-42841
Grav CMS vulnerable to stored XSS via Markdown media attribute() action
Crítica
CVE-2026-42607
Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
Alta
CVE-2026-42843
Grav API Privilege Escalation to Super Admin
Media
CVE-2026-42267
Kimai vulnerable to formula Injection via tag names in XLSX export
Alta
CVE-2026-43874
AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.