Alta
CVE-2026-75837
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 423
Restablecer filtros
Alta
CVE-2026-76839
Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
Baja
CVE-2026-72701
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection
Baja
CVE-2026-72702
Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
Media
CVE-2026-75831
Grav: Stored XSS via Markdown audio/video media <source> URL
Alta
CVE-2026-69089
Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images
Media
CVE-2026-58657
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
Alta
CVE-2026-55416
Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration
Alta
CVE-2026-86429
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
Alta
CVE-2026-86430
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
Baja
CVE-2026-55891
PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI
Crítica
CVE-2026-55634
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
Alta
CVE-2026-55212
Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
Alta
CVE-2026-55208
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
Alta
CVE-2026-57995
phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold
Media
CVE-2026-57994
phpMyFAQ public FAQ APIs expose inactive FAQ content
Alta
ghsa-fm29-4mq3-phg6
Winter: ImportExportController AJAX handlers bypass granular import/export permission gate
Baja
ghsa-7mpf-4465-7fc2
Winter: Stored XSS through Backend List widget image columns
Media
CVE-2026-79773
Winter: Local File Inclusion through =include directives in JavaScript asset compilation
Media
CVE-2026-54177
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
Crítica
CVE-2026-54133
jmespath.php has CompilerRuntime code injection via unescaped function names
Media
CVE-2026-47132
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration
Media
CVE-2026-45694
LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.title JavaScript assignment
Crítica
CVE-2026-63221
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.