Media
CVE-2026-25483
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.609
Media
CVE-2026-25482
Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
Media
CVE-2026-25228
SignalK Server has Path Traversal leading to information disclosure
Baja
CVE-2026-25224
Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream
Alta
CVE-2026-25223
Fastify's Content-Type header tab character allows body validation bypass
Crítica
CVE-2026-25521
locutus is vulnerable to Prototype Pollution
Crítica
CVE-2026-25510
CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor
Media
CVE-2026-25509
CI4MS Vulnerable to User Email Enumeration via Password Reset Flow
Crítica
CVE-2026-25505
Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication
Crítica
CVE-2026-25481
Langroid has WAF Bypass Leading to RCE in TableChatAgent
Alta
CVE-2026-25153
@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
Crítica
CVE-2026-25142
SandboxJS Vulnerable to Prototype Pollution -> Sandbox Escape -> RCE
Alta
CVE-2026-1730
OS DataHub Maps <= 1.8.3 - Authenticated (Author+) Arbitrary File Upload
Media
CVE-2026-1371
Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action
Alta
CVE-2026-1375
Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion
Media
CVE-2026-1770
Crafter CMS has Improper Control of Dynamically-Managed Code Resources
Alta
CVE-2026-0617
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting
Alta
CVE-2026-24737
jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution
Alta
CVE-2026-24133
jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
Media
CVE-2026-24043
jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)
Alta
CVE-2026-1058
Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field
Media
CVE-2026-24040
jsPDF has Shared State Race Condition in addJS Plugin
Alta
CVE-2026-23997
FacturaScripts has Stored Cross-Site Scripting (XSS) in "Observations" field via History View
Alta
CVE-2026-1065
Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG file
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.