Crítica
ghsa-qxvg-h7q2-hcxh
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.534
Alta
CVE-2026-54317
Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
Crítica
CVE-2026-54350
Budibase has nonymous NoSQL operator injection via published-app query templates
Alta
CVE-2026-55173
AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink
Alta
CVE-2026-45049
OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet
Alta
CVE-2026-45048
OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC
Media
CVE-2026-55423
Langflow: Logout button does not clear session
Alta
Explotada en ataques
CVE-2026-55255
Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
Crítica
CVE-2026-55450
Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
Alta
CVE-2026-55446
Langflow: Unauthenticated DoS through multipart form boundary file upload
Crítica
CVE-2026-48519
Langflow: Unauthenticated RCE in Shareable Playgrounds
Media
CVE-2026-48520
Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read
Alta
CVE-2026-33760
Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints
Media
CVE-2026-11370
WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter
Alta
CVE-2026-9643
WP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging
Media
CVE-2026-9620
WP Latest Posts <= 5.0.11 - Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute
Alta
CVE-2026-4297
Welcome Software Publishing <= 0.0.31 - Authenticated (Subscriber+) Arbitrary Options Update to Privilege Escalation via 'nc.setOption' XML-RPC Method
Media
CVE-2026-8896
MIR blocks and shortcodes <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Alta
CVE-2026-12100
URL Preview <= 1.0 - Unauthenticated Server-Side Request Forgery via 'url' Parameter
Alta
CVE-2026-12095
Kargo Takip <= 1.2 - Unauthenticated Server-Side Request Forgery via 'api_url' Parameter
Media
CVE-2026-12094
Advanced Contact Form 7 <= 1.0.0 - Missing Authorization to Unauthenticated Arbitrary Contact Form Submission Deletion via 'form_id' Parameter
Media
CVE-2026-11997
Bulk SEO Image <= 1.1 - Cross-Site Request Forgery to Settings Update
Media
CVE-2026-10552
Blue Captcha <= 2.0.1 - Cross-Site Request Forgery via 'blcap_action' Parameter
Media
CVE-2026-9724
MotorDesk <= 1.1.2 - Cross-Site Request Forgery to Settings Update
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.