Alta
CVE-2026-4304
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.593
Media
CVE-2026-2729
Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter
Alta
CVE-2026-39852
Quarkus has Authentication/Authorization bypasses
Alta
CVE-2026-40075
OpenMRS ModuleResourcesServlet has Path Traversal that Leads to Arbitrary File Read
Baja
CVE-2026-41358
OpenClaw: Slack thread context could include messages from non-allowlisted senders
Crítica
CVE-2026-24118
VM2 Sandbox Breakout Through __lookupGetter__
Media
CVE-2026-4362
ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite
Media
CVE-2026-6501
jOpenDocument has an improper restriction of XML external entity reference vulnerability
Crítica
CVE-2026-5294
GeekyBot <= 1.2.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation via 'geekybot_frontendajax' AJAX Action
Alta
CVE-2026-3456
GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.2.0 - Unauthenticated SQL Injection via 'attributekey'
Media
CVE-2026-4665
WP Carousel Free <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute
Media
CVE-2026-5159
Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter
Media
CVE-2026-2948
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl'
Media
CVE-2026-5957
EmailKit <= 1.6.5 - Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter
Alta
CVE-2026-4803
Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta
Media
CVE-2026-2868
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG'
Media
CVE-2026-4409
Subscribe To Comments Reloaded <= 240119 - Improper Authorization to Unauthenticated Arbitrary Subscription Management
Alta
CVE-2026-5100
AWP Classifieds <= 4.4.6 - Unauthenticated SQL Injection via 'regions'
Media
CVE-2026-4730
Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'chartid' Shortcode Attribute
Media
CVE-2026-6704
Blog Settings <= 1.0 - Reflected Cross-Site Scripting via 'page' Parameter
Media
CVE-2026-6696
Zingaya Click-to-Call <= 1.0 - Reflected Cross-Site Scripting via 'email' Parameter
Media
CVE-2026-6702
Publish 2 Ping.fm <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpPingPingKey' Parameter
Media
CVE-2026-6701
addfreespace <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page
Media
CVE-2026-6700
DX Sources <= 2.0.1 - Cross-Site Request Forgery to Settings Update
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.