Sin evaluar
CVE-2026-13236
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 3.404
Restablecer filtros
Sin evaluar
CVE-2026-13235
drupal/ai - SA-CONTRIB-2026-055
Sin evaluar
CVE-2026-13234
drupal/ai - SA-CONTRIB-2026-054
Sin evaluar
CVE-2026-13233
drupal/ai_provider_openai - SA-CONTRIB-2026-053
Sin evaluar
CVE-2026-13231
drupal/admin_feedback - SA-CONTRIB-2026-051
Alta
CVE-2026-54329
Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
Baja
CVE-2026-55542
Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL
Media
CVE-2026-49976
Snipe-IT Vulnerable to User Account Escalation via CSV Import
Media
CVE-2026-49205
phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)
Media
CVE-2026-48500
Filament: Unauthenticated temporary file upload on auth pages
Media
CVE-2026-48492
Snipe-IT's selectlist visibility is too permissive
Baja
CVE-2026-48488
phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing
Media
CVE-2026-48166
Filament: Timing-based user enumeration on login page
Media
CVE-2026-48157
Slim has Reflected XSS in the HtmlErrorRenderer
Media
CVE-2026-60092
AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel
Alta
CVE-2026-55173
AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink
Media
CVE-2026-44585
Paymenter has broken object level authorization via service reference manipulation on ticket creation
Media
CVE-2026-44584
Paymenter doesn't reset email verification status after email change
Media
CVE-2026-44583
Paymenter has Blind Unauthenticated SSRF on the Paypal gateway module
Media
CVE-2026-33731
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data
Alta
CVE-2026-33692
AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration
Media
CVE-2026-33684
AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions
Alta
CVE-2026-55878
symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest
Media
CVE-2026-55877
symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.