Alta
CVE-2026-102675
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.528
Alta
CVE-2026-102676
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
Alta
CVE-2026-102677
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
Media
ghsa-253c-mchw-3w2r
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
Media
ghsa-r3ph-w7gj-g6xm
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
Alta
CVE-2026-65954
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()
Alta
CVE-2026-76844
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
Alta
CVE-2026-96649
Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)
Media
CVE-2026-97243
AllAble Connector <= 0.13.4 - Missing Authorization
Media
CVE-2026-81930
Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}.sno
Media
CVE-2026-81914
Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that del
Media
CVE-2026-97241
BackupEase – Scheduled Backup, Restore & Site Migration <= 2.2.2 - Unauthenticated Information Exposure
Media
CVE-2026-97240
StifLi Backup Tools <= 2.2.7 - Unauthenticated Information Exposure
Crítica
CVE-2026-96349
SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP <= 2.1.8 - Unauthenticated Remote Code Execution
Media
CVE-2026-97244
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.19 - Authenticated (Contributor+) Path Traversal
Media
CVE-2026-97239
MCP Content Manager Lite <= 1.1.0 - Missing Authorization
Media
CVE-2026-93624
Music Player for WooCommerce <= 1.9.1 - Authenticated (Shop Manager+) PHP Object Injection
Alta
CVE-2026-95531
WPBot – ChatBot Conversational Forms <= 1.5.0 - Authenticated (Subscriber+) PHP Object Injection
Media
CVE-2026-94499
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.12.2 - Missing Authorization
Alta
CVE-2026-93512
JW Player for WordPress <= 2.3.11 - Unauthenticated Stored Cross-Site Scripting
Alta
CVE-2026-97250
Geo Mashup <= 1.13.21 - Unauthenticated Stored Cross-Site Scripting
Media
CVE-2026-96818
WP Express Checkout (Fast Payments via PayPal & Stripe) <= 2.4.9 - Missing Authorization
Media
CVE-2026-94122
Responsive Slider Gallery – Responsive Image Photo Slider <= 1.5.5 - Authenticated (Editor+) PHP Object Injection
Alta
CVE-2026-96822
Books Gallery – Book Showcase, Library & Affiliate Plugin <= 4.8.3 - Unauthenticated SQL Injection
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.