Conoce las vulnerabilidades. Protege tus aplicaciones.

Media 09.10.2026

CVE-2026-107844

Contao: Salto de directorio en el controlador de imágenes

Un salto de directorio en el controlador de imágenes de Contao permite a usuarios no autenticados leer ciertos archivos de imagen fuera de la raíz web y comprobar la existencia de rutas en el proyecto.

Composer

contao/core-bundle

Media 02.09.2026

CVE-2026-61450

Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

Composer

getgrav/grav

Media 01.09.2026

CVE-2026-69127

Kirby: System path exposure from error messages in the REST API

Composer

getkirby/cms

Crítica 16.07.2026

CVE-2026-55579

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

Composer

pheditor/pheditor

Media 29.05.2026

CVE-2026-47232

Admidio PKCS#12 private key export action lacks CSRF protection

Composer

admidio/admidio

Alta 27.05.2026

CVE-2026-45332

Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint

Composer

automad/automad

Alta 15.05.2026

CVE-2026-56345

AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin

Composer

wwbn/avideo

Media 07.05.2026

CVE-2026-27892

FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download

Composer

facturascripts/facturascripts

Media 05.05.2026

CVE-2026-42610

Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass

Composer

getgrav/grav

Media 05.05.2026

CVE-2026-43875

AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover

Composer

wwbn/avideo

Alta 05.05.2026

CVE-2026-43873

AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server

Composer

wwbn/avideo

Media 30.03.2026

CVE-2026-34362

AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()

Composer

wwbn/avideo

Crítica 26.03.2026

CVE-2026-33867

AVideo has Plaintext Video Password Storage

Composer

wwbn/avideo

Alta 25.03.2026

CVE-2026-33723

AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter

Composer

wwbn/avideo

Alta 20.03.2026

CVE-2026-33512

AVideo has an unauthenticated decrypt oracle leaking any ciphertext

Composer

wwbn/avideo

Alta 20.03.2026

CVE-2026-33482

AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()

Composer

wwbn/avideo

Crítica 20.03.2026

CVE-2026-33478

AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection

Composer

wwbn/avideo

Alta 18.03.2026

CVE-2026-33204

SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering

Composer

kelvinmo/simplejwt

Media 17.03.2026

CVE-2026-33041

AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php

Composer

wwbn/avideo

Alta 17.03.2026

CVE-2026-33038

AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments

Composer

wwbn/avideo

Media 16.12.2025

CVE-2025-68113

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

Composer Java / Kotlin (Maven) npm Python (PyPI)

altcha-org/altcha, org.altcha:altcha, altcha-lib +1

Media 14.11.2025

CVE-2025-64714

PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal

Composer

privatebin/privatebin

Alta 31.10.2024

CVE-2024-51478

YesWiki Uses a Broken or Risky Cryptographic Algorithm

Composer

yeswiki/yeswiki

Media 29.08.2024

CVE-2024-45440

Drupal Full Path Disclosure

Composer Drupal

drupal/core, drupal/core-recommended, drupal/drupal +1