Baja
CVE-2026-41659
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 853
Restablecer filtros
Media
CVE-2026-41658
Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items
Media
CVE-2026-41657
Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php
Media
CVE-2026-41656
Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read
Media
CVE-2026-41655
Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials
Media
CVE-2026-42206
OpenID Connect nonce generated but never validated — ID token replay attack
Alta
CVE-2026-41587
CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution
Alta
CVE-2026-40902
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
Crítica
CVE-2026-34084
PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
Media
CVE-2026-32699
FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field
Media
CVE-2026-6982
ShowDoc has an Injection vulnerability
Alta
CVE-2026-41325
Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection
Baja
CVE-2026-41498
Kimai has Missing Object-Level Authorization in the Team API
Media
CVE-2026-40099
Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter
Media
CVE-2026-41887
Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
Crítica
CVE-2026-41203
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
Crítica
CVE-2026-41202
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
Alta
ghsa-mh6w-vxff-9wqp
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
Alta
CVE-2026-40488
OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution
Alta
CVE-2026-25524
OpenMage LTS: Phar Deserialization leads to Remote Code Execution
Alta
CVE-2026-41143
YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()
Alta
CVE-2026-41570
PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes
Baja
CVE-2026-80199
Kimai: Username enumeration via timing on X-AUTH-USER
Crítica
CVE-2026-23500
Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.