Media
CVE-2026-4020
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.602
Crítica
CVE-2026-3300
Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field
Alta
CVE-2026-5130
Debugger & Troubleshooter <= 1.3.2 - Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation
Crítica
CVE-2026-4257
Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
Media
CVE-2026-45214
Xpro Elementor Addons <= 1.5.1 - Authenticated (Contributor+) SQL Injection
Media
CVE-2025-15433
Shared Files – Frontend File Upload Form & Secure File Sharing < 1.7.58 - Authenticated (Contributor+) Arbitrary File Download
Media
CVE-2026-45213
BEAR <= 1.1.7.1 - Authenticated (Shop manager+) SQL Injection
Crítica
CVE-2025-15488
Responsive Plus – Elementor Templates & Starter Sites < 3.4.3 - Unauthenticated Arbitrary Code Execution
Crítica
CVE-2026-1969
ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload
Media
CVE-2026-1430
WP Lightbox 2 < 3.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Media
CVE-2026-1890
LeadConnector < 3.0.22 - Missing Authorization
Alta
CVE-2026-0560
A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function
Alta
CVE-2026-0562
A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The `respond_request()` function i
Crítica
CVE-2026-0558
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not e
Media
CVE-2026-35651
OpenClaw has ACP CLI approval prompt ANSI escape sequence injection
Media
CVE-2026-35661
OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State
Media
CVE-2026-35646
OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token
Media
CVE-2026-35654
OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback
Media
CVE-2026-35645
OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin`
Media
CVE-2026-35664
OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing
Media
CVE-2026-35640
OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation
Alta
CVE-2026-35629
OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)
Baja
CVE-2026-35617
OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName
Alta
CVE-2026-35636
OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.