Media
CVE-2025-14778
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.609
Alta
CVE-2026-1486
Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens
Alta
CVE-2026-1529
Keycloak affected by improper invitation token validation
Alta
CVE-2026-1866
Name Directory <= 1.32.0 - Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form
Alta
CVE-2026-2268
Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action
Media
CVE-2026-1922
The Events Calendar Shortcode & Block <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Media
CVE-2026-25528
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
Alta
CVE-2026-25498
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
Alta
CVE-2026-25497
Craft CMS: GraphQL Asset Mutation Privilege Escalation
Media
CVE-2026-25496
Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields
Alta
CVE-2026-25495
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`
Media
CVE-2026-25494
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation
Media
CVE-2026-25493
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect
Media
CVE-2026-25492
Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
Baja
CVE-2026-25491
Craft CMS Vulnerable to Stored XSS in Entry Types Name
Media
CVE-2025-14895
PopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion
Media
CVE-2026-25480
Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)
Media
CVE-2026-25479
Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns
Alta
CVE-2026-25478
Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins
Media
CVE-2026-1722
WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation
Alta
CVE-2026-25639
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
Media
CVE-2026-0996
Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module
Media
CVE-2026-23903
Apache Shiro has an Authentication Bypass
Alta
CVE-2026-0845
WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.