Crítica
CVE-2026-47686
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.534
Alta
CVE-2026-47683
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
Media
CVE-2026-74004
Gravity Booster – Styles & Layouts for Gravity Forms <= 6.1 - Missing Authorization
Media
CVE-2026-74003
RTMForm Builder <= 1.2.7 - Missing Authorization
Media
CVE-2026-74006
WP Table Builder – Drag & Drop Table Builder <= 2.2.0 - Missing Authorization
Media
CVE-2026-74007
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 - Unauthenticated Information Exposure
Media
CVE-2026-74008
Shortcodes and extra features for Phlox theme <= 2.17.22 - Unauthenticated Information Exposure
Media
CVE-2026-74009
Razorpay for WooCommerce <= 4.8.7 - Unauthenticated Insecure Direct Object Reference
Crítica
CVE-2026-15748
Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
Alta
CVE-2026-19693
extract-zip allows arbitrary file writes through symlink archive entries
Alta
CVE-2026-53728
Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage
Alta
CVE-2026-40345
DeepmergeTS has stack exhaustion when merging recursive object graphs
Alta
CVE-2026-11801
WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint
Alta
CVE-2026-73366
Easy Google Maps <= 1.13.0 - Unauthenticated PHP Object Injection
Alta
CVE-2026-73393
Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting
Media
CVE-2026-32549
ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More < 6.5 - Missing Authorization
Alta
CVE-2026-73339
Modern Events Calendar < 7.35.0 - Unauthenticated SQL Injection
Media
CVE-2026-32466
Gravity Bookings <= 2.1 - Authenticated (Subscriber+) SQL Injection
Alta
CVE-2026-32463
Sync Post With Other Site <= 1.9.3 - Authenticated (Contributor+) Arbitrary File Upload
Media
CVE-2026-28571
Contact Form to Chat Apps | Click to Chat to Order – FormyChat <= 2.15.7 - Missing Authorization
Sin evaluar
CVE-2026-74900
openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from o
Sin evaluar
CVE-2026-74901
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify
Sin evaluar
CVE-2026-74891
openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known de
Sin evaluar
CVE-2026-74893
openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any cl
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.