Media
CVE-2026-59944
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 19
Restablecer filtros
Alta
CVE-2026-76839
Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
Alta
CVE-2026-76846
Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
Alta
CVE-2026-84361
Composer arbitrary command execution via a malicious package's Perforce source URL
Media
CVE-2026-59946
Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
Media
CVE-2026-59947
Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
Alta
CVE-2026-59948
Composer: Arbitrary file write outside vendor via malicious transitive package name
Alta
CVE-2026-45793
Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs
Alta
CVE-2026-40176
Composer has a command injection via malicious perforce repository
Alta
CVE-2026-40261
Composer has a command injection via malicious perforce reference
Baja
CVE-2025-67746
Composer is vulnerable to ANSI sequence injection
Alta
CVE-2024-35241
Composer has a command injection via malicious git branch name
Alta
CVE-2024-35242
Composer has multiple command injections via malicious git/hg branch names
Alta
CVE-2024-24821
Composer code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php
Alta
CVE-2023-43655
Composer Remote Code Execution vulnerability via web-accessible composer.phar
Alta
CVE-2015-8371
Composer allows cache poisoning from other projects built on the same host
Alta
CVE-2022-24828
Missing input validation can lead to command execution in composer
Alta
CVE-2021-41116
Improper escaping of command arguments on Windows leading to command injection
Alta
CVE-2021-29472
Composer's missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.