Conoce las vulnerabilidades. Protege tus aplicaciones.

Media 09.10.2026

CVE-2026-107851

Contao: Control de acceso incorrecto en el voter de acceso a tablas

Un defecto de caché en el voter de seguridad de Contao permite a usuarios del backend con pocos privilegios eludir permisos de módulos y acceder de forma no autorizada a tablas de la base de datos.

Composer

contao/core-bundle

Media 08.10.2026

CVE-2026-107381

svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

Composer

enshrined/svg-sanitize

Alta 07.10.2026

CVE-2026-104890

Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution

Composer

kunstmaan/bundles-cms, kunstmaan/media-bundle

Sin evaluar 07.10.2026

CVE-2026-96389

drupal/xray_audit - SA-CONTRIB-2026-206

Composer Drupal

drupal/xray_audit, xray_audit

Media 30.09.2026

CVE-2026-105829

league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

Composer

league/commonmark

Alta 29.09.2026

CVE-2026-65954

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

Composer

phpcsstandards/phpcsutils

Baja 24.09.2026

CVE-2026-57232

Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Composer

contao/contao, contao/core-bundle

Alta 24.09.2026

CVE-2026-61816

zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME

Composer

zbateson/mail-mime-parser

Alta 24.09.2026

CVE-2026-63498

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Composer

snipe/snipe-it

Media 24.09.2026

CVE-2026-62998

REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

Composer

redaxo/source

Media 23.09.2026

CVE-2026-63002

REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

Composer

redaxo/source

Media 18.09.2026

ghsa-9rcc-pmj8-ffhr

Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)

Composer

mediawiki/semantic-media-wiki

Alta 17.09.2026

CVE-2026-75837

Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Composer

getgrav/grav

Media 17.09.2026

CVE-2026-75834

Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate

Composer

getgrav/grav

Crítica 17.09.2026

CVE-2026-75827

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

Composer

getgrav/grav

Crítica 17.09.2026

CVE-2026-75828

Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

Composer

getgrav/grav

Alta 17.09.2026

CVE-2026-72695

Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

Composer

getgrav/grav

Alta 17.09.2026

CVE-2026-72697

Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content

Composer

getgrav/grav

Alta 17.09.2026

CVE-2026-76839

Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

Composer

getgrav/grav

Alta 17.09.2026

CVE-2026-76846

Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

Composer

getgrav/grav

Alta 17.09.2026

CVE-2026-72698

Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths

Composer

getgrav/grav

Baja 17.09.2026

CVE-2026-72701

Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection

Composer

getgrav/grav

Media 17.09.2026

CVE-2026-75831

Grav: Stored XSS via Markdown audio/video media <source> URL

Composer

getgrav/grav

Alta 17.09.2026

CVE-2026-69089

Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images

Composer

getgrav/grav