Media
CVE-2026-25509
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.602
Crítica
CVE-2026-25505
Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication
Crítica
CVE-2026-25481
Langroid has WAF Bypass Leading to RCE in TableChatAgent
Alta
CVE-2026-25153
@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
Crítica
CVE-2026-25142
SandboxJS Vulnerable to Prototype Pollution -> Sandbox Escape -> RCE
Alta
CVE-2026-1730
OS DataHub Maps <= 1.8.3 - Authenticated (Author+) Arbitrary File Upload
Media
CVE-2026-1371
Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action
Alta
CVE-2026-1375
Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion
Media
CVE-2026-1770
Crafter CMS has Improper Control of Dynamically-Managed Code Resources
Alta
CVE-2026-0617
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting
Alta
CVE-2026-24737
jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution
Alta
CVE-2026-24133
jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
Media
CVE-2026-24043
jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)
Alta
CVE-2026-1058
Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field
Media
CVE-2026-24040
jsPDF has Shared State Race Condition in addJS Plugin
Alta
CVE-2026-23997
FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History View
Alta
CVE-2026-1065
Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG file
Crítica
CVE-2026-23515
Signal K set-system-time plugin vulnerable to RCE - Command Injection
Media
CVE-2026-1447
Mail Mint <= 1.19.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Media
CVE-2026-23476
FacturaScripts is Vulnerable to Reflected XSS
Media
CVE-2026-1210
Happy Addons for Elementor <= 3.20.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta Field
Media
CVE-2025-14274
Unlimited Elements for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget
Media
CVE-2026-0950
Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data
Media
CVE-2026-0909
WP ULike <= 4.8.3.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Log Deletion via 'id' Parameter
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.