Media
CVE-2026-39572
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.593
Media
CVE-2026-39569
12 Step Meeting List <= 3.19.9 - Missing Authorization
Media
CVE-2026-39482
Post Expirator <= 4.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Media
CVE-2026-42646
TaxoPress <= 3.44.0 - Authenticated (Editor+) SQL Injection
Media
CVE-2026-3427
Yoast SEO <= 27.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block Attribute
Alta
CVE-2026-4314
The Ultimate WordPress Toolkit – WP Extended <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module
Alta
CVE-2026-3629
Import and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fields
Media
CVE-2026-39565
WpTravelly <= 2.1.7 - Missing Authorization
Alta
CVE-2026-33236
NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite
Alta
CVE-2026-33231
Unauthenticated remote shutdown in nltk.app.wordnet_app
Media
CVE-2026-33230
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nltk
Alta
CVE-2026-33513
AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)
Alta
CVE-2026-33512
AVideo has an unauthenticated decrypt oracle leaking any ciphertext
Alta
CVE-2026-33508
Parse Server LiveQuery subscription query depth bypass
Alta
CVE-2026-33507
AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload
Alta
CVE-2025-55988
DreamFactory has a directory traversal
Alta
CVE-2026-33154
dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver
Crítica
CVE-2026-33502
AVideo has Unauthenticated SSRF via plugin/Live/test.php
Media
CVE-2026-33501
AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin
Media
CVE-2026-33500
AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization
Media
CVE-2026-33499
AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php
Alta
CVE-2026-33498
Parse Server has a query condition depth bypass via pre-validation transform pipeline
Media
CVE-2026-86252
h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)
Baja
CVE-2026-33490
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.