Media
CVE-2026-40486
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 7.070
Restablecer filtros
Media
CVE-2026-40479
Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget
Media
CVE-2026-86200
PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket
Media
CVE-2026-6367
Drupal core allows Cross-Site Scripting (XSS)
Media
CVE-2026-6366
Drupal core allows Object Injection
Media
CVE-2026-6365
Drupal core is Vulnerable to Cross-Site Scripting
Media
CVE-2026-41130
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
Media
CVE-2026-41129
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations
Media
CVE-2026-41128
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
Alta
CVE-2026-41064
WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection
Media
CVE-2026-41063
WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS
Media
CVE-2026-41062
WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters
Media
CVE-2026-41061
WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver
Alta
CVE-2026-41060
WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL
Media
CVE-2026-41058
WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal
Alta
CVE-2026-41057
WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses
Alta
CVE-2026-41056
WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover
Media
CVE-2026-41055
WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF
Media
CVE-2026-40935
CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure
Media
CVE-2026-40929
WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators
Media
CVE-2026-40928
WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion
Alta
CVE-2026-40926
WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)
Alta
CVE-2026-40925
WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
Crítica
CVE-2026-40911
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.