Alta
CVE-2025-54003
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.632
Media
CVE-2025-22726
nK Themes Helper <= 1.7.9 - Authenticated (Subscriber+) Server-Side Request Forgery
Media
CVE-2026-27090
Kenta Companion <= 1.3.3 - Cross-Site Request Forgery
Media
CVE-2025-22715
Attractive Donations System - Easy Stripe & Paypal donations <= 1.25 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
Media
CVE-2026-22186
Bio-Formats has an XML External Entity (XXE) vulnerability
Media
CVE-2026-22187
Bio-Formats performs unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing
Media
CVE-2025-14984
Gutenverse Form <= 2.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Alta
CVE-2026-22244
OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE
Media
CVE-2026-22242
CoreShop Vulnerable to SQL Injection via Admin Reports
Alta
CVE-2026-22028
Preact has JSON VNode Injection issue
Media
CVE-2026-21894
n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks
Crítica
CVE-2026-21858
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
Alta
CVE-2025-69264
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
Alta
CVE-2025-69263
pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies
Alta
CVE-2025-69262
pnpm vulnerable to Command Injection via environment variable substitution
Media
CVE-2025-13679
Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details
Crítica
CVE-2025-61492
terminal-controller-mcp vulnerable to Command Injection
Alta
CVE-2025-67364
fast-filesystem-mcp has a Path Traversal vulnerability
Crítica
CVE-2025-12543
Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
Media
CVE-2025-61782
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authen
Media
CVE-2025-66560
Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write
Media
CVE-2025-12640
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement
Media
CVE-2025-14275
Jeg Elementor Kit <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
Media
CVE-2025-47500
Stackable <= 3.19.5 - Authenticated (Author+) Stored Cross-Site Scripting
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.