Sin evaluar
pysec-2026-594
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.543
Alta
CVE-2026-12142
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter
Sin evaluar
pysec-2026-593
Malicious code in magique-ai (PyPI)
Sin evaluar
pysec-2026-592
Malicious code in magique (PyPI)
Sin evaluar
pysec-2026-591
Malicious code in funcdesc (PyPI)
Sin evaluar
pysec-2026-590
Malicious code in executor-http (PyPI)
Media
CVE-2026-12754
VikBooking Hotel Booking Engine & PMS <= 1.8.12 - Reflected Cross-Site Scripting via 'layoutstyle' Parameter
Media
CVE-2026-13454
MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter
Sin evaluar
pysec-2026-589
Malicious code in executor-engine (PyPI)
Alta
CVE-2026-12158
RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter
Media
CVE-2026-12408
Slim SEO <= 4.9.8 - Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via 'object.ID' Parameter
Media
CVE-2026-55219
Paymenter has race condition in payWithCredit() that enables credit double-spend
Crítica
CVE-2026-11387
SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
Media
CVE-2026-10096
Qi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter
Media
CVE-2026-12435
Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter
Media
CVE-2026-12732
LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute
Media
CVE-2026-13733
Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute
Media
CVE-2026-48808
Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
Media
CVE-2026-48807
Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
Media
CVE-2026-48806
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
Baja
CVE-2026-48805
Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
Media
CVE-2026-48796
CefSharp.Common: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder
Alta
CVE-2026-48795
@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754
Alta
CVE-2026-58168
DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.