Alta
CVE-2026-55878
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 3.406
Restablecer filtros
Media
CVE-2026-55877
symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses
Alta
CVE-2026-55692
StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled
Media
CVE-2026-55795
Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
Media
ghsa-78vr-q6cf-c7p6
Craft Commerce: Partial Payment Amount Without Lower Bound Validation
Crítica
CVE-2026-55791
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
Alta
CVE-2026-55691
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template
Alta
CVE-2026-55690
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text
Media
CVE-2026-49216
symfony/ux-autocomplete: XSS via unescaped AJAX response data
Baja
CVE-2026-49215
symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted
Baja
CVE-2026-49212
symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding
Media
CVE-2026-49211
symfony/ux-autocomplete: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
Media
CVE-2026-49210
symfony/ux-live-component: XSS via attacker-controlled child component tag
Baja
CVE-2026-49209
symfony/ux-live-component: Denial of service via unbounded batch action requests
Media
CVE-2026-49208
ux-live-component: Format-less date LiveProps parsed with the permissive DateTime constructor
Media
CVE-2026-55767
guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts
Media
CVE-2026-55766
guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
Media
CVE-2026-55568
guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext
Media
CVE-2026-55375
canto-saas-api: OAuth credentials exposed in URL query string and exception messages
Media
CVE-2026-55374
canto-saas-api: Authenticated API requests can be redirected via unencoded path variables
Media
ghsa-5739-39v2-5754
PHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle
Alta
ghsa-jc38-x7x8-2xc8
PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks
Alta
ghsa-3prj-6hqw-cm82
PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service
Media
ghsa-6vvh-pxr4-25r7
PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.