Alta
CVE-2026-74794
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.593
Alta
CVE-2026-74795
Scriban has Uncontrolled Recursion in Parser Leads to Stack Overflow and Process Crash (Denial of Service)
Media
CVE-2026-33397
Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR
Alta
CVE-2026-27953
ormar Pydantic Validation Bypass via __pk_only__ and __excluded__ Kwargs Injection in Model Constructor
Media
CVE-2026-2421
ilGhera Carta Docente for WooCommerce <= 1.5.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'cert' Parameter
Media
CVE-2026-2432
CM Custom Reports <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels
Media
CVE-2026-3550
RockPress <= 1.0.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via AJAX Actions
Alta
CVE-2026-4267
Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI
Alta
CVE-2026-33354
AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`
Crítica
CVE-2026-33352
AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)
Crítica
CVE-2026-33351
AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass
Media
CVE-2026-33349
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser
Media
CVE-2026-33347
league/commonmark has an embed extension allowed_domains bypass
Media
CVE-2026-33326
@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)
Media
CVE-2026-33323
Parse Server email verification resend page leaks user existence
Alta
ghsa-2mhw-8qcg-gr96
skia-python vendors vulnerable libfreetype because of pinned cibuildwheel version
Media
CVE-2026-33311
SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials
Alta
CVE-2026-33228
Prototype Pollution via parse() in NodeJS flatted
Media
CVE-2026-33297
AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php
Baja
CVE-2026-33296
AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php
Alta
CVE-2026-33295
AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php
Media
CVE-2026-33294
AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources
Alta
CVE-2026-33293
AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
Alta
CVE-2026-33292
AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.