Alta
CVE-2026-62368
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 43
Restablecer filtros
Sin evaluar
CVE-2026-96382
drupal/diba_carousel - SA-CONTRIB-2026-191
Media
CVE-2026-73858
Solspace Freeform: Limited Twig template injection via submitted field values
Media
CVE-2026-75834
Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate
Crítica
CVE-2026-75827
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
Alta
CVE-2026-72698
Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths
Baja
CVE-2026-72702
Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
Media
CVE-2026-55593
Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection
Media
CVE-2026-47227
Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`
Alta
CVE-2026-45704
Pimcore has a CustomReports Share Bypass
Media
CVE-2026-45703
Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export
Media
CVE-2026-45008
phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins
Alta
CVE-2026-46366
phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query
Media
CVE-2026-46365
phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags
Media
CVE-2026-41656
Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read
Media
CVE-2026-41655
Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials
Alta
CVE-2026-25524
OpenMage LTS: Phar Deserialization leads to Remote Code Execution
Media
CVE-2026-40929
WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators
Alta
CVE-2026-40926
WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)
Media
CVE-2026-40908
WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version
Alta
CVE-2026-56341
AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records
Alta
CVE-2026-33479
AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin
Media
CVE-2026-31823
Sylius Vulnerable to Authenticated Stored XSS
Media
CVE-2026-31822
Sylius has a XSS vulnerability in checkout login form
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.