Baja
CVE-2026-44242
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.587
Crítica
CVE-2026-44262
Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules
Media
CVE-2026-86256
wger: trainer_login open redirect - ?next= parameter not validated against host
Crítica
CVE-2026-43948
wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
Alta
CVE-2026-86257
wger: CSV/TSV formula injection in gym member export (first_name/last_name)
Alta
CVE-2026-44240
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering
Media
CVE-2026-80198
Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/export templates
Media
CVE-2026-80202
Kimai has Missing Voter Check that Allows Cross-Team Timesheet Manipulation
Alta
CVE-2026-44232
dssrf: every IPv6 category bypasses is_url_safe
Alta
CVE-2024-27354
phpseclib: guardrails needed on isPrime and randomPrime
Alta
CVE-2026-44012
Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
Alta
CVE-2026-44011
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
Alta
CVE-2026-44010
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
Media
ghsa-4c35-wcg5-mm9h
next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys
Baja
ghsa-r27j-894h-3w3p
mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`
Alta
CVE-2026-42280
Auth.js SDK has Improper Permission Checking
Crítica
CVE-2026-29090
Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API
Crítica
CVE-2026-29080
Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API
Alta
CVE-2026-6692
Slider Revolution 7.0.0 - 7.0.10 - Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url
Alta
CVE-2026-7252
WP-Optimize <= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta
Media
CVE-2026-8026
Flowise: Bcrypt Password Hash Exposure
Alta
CVE-2026-4348
BetterDocs Pro <= 3.7.0 - Unauthenticated SQL Injection via Encyclopedia 'limit' Parameter
Media
CVE-2026-6214
Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook
Media
CVE-2026-4807
Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.