Media
CVE-2026-0552
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.593
Media
CVE-2025-15064
Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets
Media
CVE-2025-13368
Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
Media
CVE-2026-2924
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad'
Media
CVE-2026-2949
Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget
Media
CVE-2026-3571
Pie Register – User Registration, Profiles & Content Restriction <= 3.8.4.8 - Missing Authorization to Unauthenticated Registration Form Status Modification
Alta
CVE-2026-5463
pymetasploit3 vulnerable to command injection in console.run_module_with_output()
Baja
CVE-2026-35537
Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler
Media
CVE-2026-35540
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages
Media
CVE-2026-35541
Roundcube Webmail: Incorrect password comparison in the password plugin
Media
CVE-2026-35542
Roundcube: Bypass of remote image blocking via crafted BODY background attribute
Baja
CVE-2026-35538
Roundcube Webmail: Unsanitized IMAP SEARCH command arguments
Media
CVE-2026-35543
Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message
Media
CVE-2026-35545
Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message
Media
CVE-2026-35544
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages
Media
CVE-2026-35539
Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode
Alta
CVE-2026-35536
Tornado has cookie attribute injection via .RequestHandler.set_cookie
Crítica
CVE-2026-35039
fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)
Baja
CVE-2026-35038
Signal K Server: Arbitrary Prototype Read via `from` Field Bypass
Crítica
CVE-2026-34989
CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Alta
CVE-2026-35168
OpenSTAManager: SQL Injection via Aggiornamenti Module
Media
CVE-2026-65912
DOMPurify ADD_ATTR predicate skips URI validation
Media
CVE-2026-65913
DOMPurify USE_PROFILES prototype pollution allows event handlers
Alta
ghsa-ghc5-95c2-vwcv
Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.