Media
CVE-2026-3004
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.593
Media
b1971bb8-fb24-40f6-bbd8-60b5dc1f0822
WP Business Intelligence Lite <= 3.2.0 - Missing Authorization
Alta
CVE-2026-6261
Betheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload
Alta
ghsa-fc86-6rv6-2jpm
webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
Alta
ghsa-gxxh-8vcj-w2mh
livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler
Media
CVE-2026-6262
Betheme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload'
Alta
CVE-2026-38751
OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality
Crítica
CVE-2026-42569
phpVMS has an /importer authorization bypass causing full database wipe
Alta
CVE-2026-100856
AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field
Media
CVE-2026-100855
AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration
Media
CVE-2026-100854
AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption
Alta
CVE-2026-42606
AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass
Alta
CVE-2026-42605
AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload
Media
CVE-2026-42333
quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations
Crítica
CVE-2026-41901
Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns
Media
CVE-2026-44994
OpenClaw's Gateway Control UI bootstrap config required Gateway auth
Media
CVE-2026-44113
OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes
Media
CVE-2026-44112
OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root
Alta
CVE-2026-41893
Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)
Media
CVE-2026-41891
CI4MS has a Deactivated User Session Bypass (active=0)
Media
CVE-2026-41890
CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess
Media
CVE-2026-44115
OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs
Alta
CVE-2026-44118
OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
Media
CVE-2026-45003
OpenClaw: Workspace dotenv files cannot override connector endpoint hosts
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.