Alta
CVE-2026-12158
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.534
Media
CVE-2026-12408
Slim SEO <= 4.9.8 - Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via 'object.ID' Parameter
Media
CVE-2026-55219
Paymenter has race condition in payWithCredit() that enables credit double-spend
Crítica
CVE-2026-11387
SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
Media
CVE-2026-10096
Qi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter
Media
CVE-2026-12435
Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter
Media
CVE-2026-12732
LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute
Media
CVE-2026-13733
Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute
Media
CVE-2026-48808
Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
Media
CVE-2026-48807
Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
Media
CVE-2026-48806
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
Baja
CVE-2026-48805
Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
Media
CVE-2026-48796
CefSharp.Common: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder
Alta
CVE-2026-48795
@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754
Alta
CVE-2026-58168
DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools
Baja
CVE-2026-48791
Sigstore Java has a vulnerability with bundle verification of integratedTime
Alta
CVE-2026-49473
@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation
Alta
CVE-2026-12224
Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint
Alta
CVE-2026-1239
Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint
Alta
CVE-2026-11823
BookingPress Appointment Booking Pro <= 5.7.1 - Unauthenticated SQL Injection via 'store_service_date' Parameter
Alta
CVE-2026-47198
Paymenter has URL parameter injection that bypasses paid plan limits at checkout
Media
CVE-2026-11981
GiveWP <= 4.15.3 - Cross-Site Request Forgery
Media
CVE-2026-12113
Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure
Crítica
CVE-2026-6070
WP-BusinessDirectory <= 4.0.1 - Unauthenticated Arbitrary File Deletion via Path Traversal via '_filename' Parameter
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.