Alta
CVE-2026-42762
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.587
Media
CVE-2026-48865
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.6 - Reflected Cross-Site Scripting
Alta
CVE-2026-48871
MW WP Form <= 5.1.3 - Unauthenticated Stored Cross-Site Scripting
Media
CVE-2026-8382
Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters
Alta
CVE-2026-42754
Favicon by RealFaviconGenerator <= 1.3.46 - Unauthenticated Stored Cross-Site Scripting
Media
CVE-2026-42760
Backup and Staging by WP Time Capsule <= 1.22.25 - Missing Authorization
Alta
CVE-2026-42757
WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce < 4.08.253 - Authenticated (Subscriber+) Arbitrary File Deletion
Alta
CVE-2026-42755
TableOn – WordPress Posts Table Filterable <= 1.0.5.1 - Unauthenticated SQL Injection
Crítica
CVE-2026-42758
WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce < 4.08.253 - Unauthenticated Privilege Escalation
Alta
CVE-2026-42759
Affiliate Super Assistent <= 1.10.1 - Unauthenticated Stored Cross-Site Scripting
Crítica
CVE-2026-47416
praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}
Crítica
CVE-2026-47410
praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset
Crítica
CVE-2026-47407
PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation
Crítica
CVE-2026-47391
PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
Crítica
CVE-2026-47392
PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)
Media
CVE-2026-47395
PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
Crítica
CVE-2026-47396
PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset
Media
CVE-2026-47390
PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
Alta
CVE-2026-47398
PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334
Alta
CVE-2026-47266
formie's unauthenticated front-end submission editing can overwrite existing submissions
Crítica
CVE-2026-76242
stigmem-node's federation peer registration lacked explicit out-of-band approval
Alta
CVE-2026-76241
stigmem-node's unsigned plugin override could be enabled without a second explicit acknowledgment
Crítica
CVE-2026-76244
stigmem-node's federation insecure transport settings may allow non-loopback cleartext federation
Alta
CVE-2026-76240
stigmem-node's Postgres schema identifier handling required defensive quoting
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.