Media
CVE-2026-42202
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 7.039
Restablecer filtros
Media
CVE-2026-40099
Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter
Alta
CVE-2026-34587
Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
Media
CVE-2026-32870
Kirby has XML injection in its XML creator toolkit
Media
CVE-2026-41887
Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
Sin evaluar
CVE-2026-6871
drupal/obfuscate - SA-CONTRIB-2026-033
Crítica
CVE-2026-41203
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
Crítica
CVE-2026-41202
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
Media
CVE-2026-41201
CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS
Alta
ghsa-mh6w-vxff-9wqp
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
Baja
CVE-2026-6745
Bagisto affected by Cross-site Scripting
Baja
CVE-2026-6744
Bagisto affected by Server-Side Request Forgery
Alta
CVE-2026-40488
OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution
Baja
CVE-2026-29179
October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations
Baja
CVE-2026-27937
October CMS: Reflected XSS via DataTable Form Widget
Media
CVE-2026-26274
October CMS has Safe Mode Bypass via Twig Database Write Operations
Media
CVE-2026-26067
October CMS has Safe Mode Bypass via CSS Preprocessor Compilers
Alta
CVE-2026-31018
Dolibarr Allows Code Injection through its Website Module
Alta
CVE-2026-31019
Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions
Media
CVE-2026-40098
OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure
Media
CVE-2026-25525
OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module
Alta
CVE-2026-25524
OpenMage LTS: Phar Deserialization leads to Remote Code Execution
Baja
CVE-2026-6626
Cockpit has NoSQL Injection Through Content Aggregation Pipelines
Alta
CVE-2026-41143
YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.