Alta
CVE-2026-69088
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 388
Restablecer filtros
Alta
CVE-2026-65608
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
Media
CVE-2026-61449
Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer
Media
CVE-2026-58657
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
Baja
CVE-2026-49400
October CMS: PHP Object Injection via Backend Widget Session Storage
Alta
CVE-2026-56825
Shopper: Missing authorization on product removal actions in CollectionProducts component
Alta
CVE-2026-56829
Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
Media
CVE-2026-56826
Shopping privilege escalation through missing authorization in Settings components
Alta
CVE-2026-56827
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
Media
CVE-2026-61450
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
Alta
CVE-2026-64850
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Media
CVE-2026-81890
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
Alta
CVE-2026-86428
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
Alta
CVE-2026-86429
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
Alta
CVE-2026-55843
Snipe-IT has an Improper Privilege Management issue
Baja
CVE-2026-55891
PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI
Crítica
CVE-2026-55634
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
Crítica
CVE-2026-55220
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
Alta
CVE-2026-55208
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
Alta
CVE-2026-55584
phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers
Alta
CVE-2026-57584
Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS
Media
CVE-2026-57994
phpMyFAQ public FAQ APIs expose inactive FAQ content
Alta
CVE-2026-63135
YOURLS has stored XSS in referrer statistics chart via crafted Referer header
Crítica
CVE-2026-59989
Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.