Media
CVE-2026-41661
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 7.039
Restablecer filtros
Alta
CVE-2026-41660
Admidio has Inverted 2FA Reset Authorization Check that Lets Group Leaders Strip Admin TOTP
Baja
CVE-2026-41659
Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment
Media
CVE-2026-41658
Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items
Media
CVE-2026-41657
Admidio Exposes Cross-Organization Member Data via Permission Check Mismatch in contacts_data.php
Media
CVE-2026-41656
Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read
Media
CVE-2026-41655
Admidio has Path Traversal in ECard Preview that Allows Reading Arbitrary Server Files Including Database Credentials
Alta
CVE-2026-42224
ipl/web is vulnerable to reflected XSS by malformed search requests
Media
CVE-2026-42206
OpenID Connect nonce generated but never validated — ID token replay attack
Alta
CVE-2026-41587
CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution
Alta
CVE-2026-40902
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
Alta
CVE-2026-40863
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
Crítica
CVE-2026-34084
PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
Alta
CVE-2026-38991
Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type
Media
CVE-2026-38993
Cockpit is vulnerable to directory traversal
Crítica
CVE-2026-38992
Cockpit is vulnerable to arbitrary code execution
Media
CVE-2026-40296
PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer
Media
CVE-2026-35453
PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer
Media
CVE-2026-32699
FacturaScripts has Insecure Parameter Handling: Unauthorized Modification of Immutable 'nick' Field
Media
CVE-2026-5362
Pimcore has an authenticated Cross-site Scripting issue
Media
CVE-2026-6982
ShowDoc has an Injection vulnerability
Alta
CVE-2026-41325
Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection
Alta
CVE-2026-6553
TYPO3 CMS Stores Cleartext Password in User Settings Module
Baja
CVE-2026-41498
Kimai has Missing Object-Level Authorization in the Team API
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.