Alta
CVE-2026-57793
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 8.950
Restablecer filtros
Alta
CVE-2026-57748
Shopify <= 1.0.0 - Authenticated (Contributor+) Local File Inclusion
Alta
CVE-2026-57796
Leedo <= 3.0.0 - Authenticated (Contributor+) Local File Inclusion
Alta
CVE-2026-57749
SportsPress Pro <= 2.7.29 - Authenticated (Contributor+) Local File Inclusion
Alta
CVE-2026-57794
Golo Framework <= 1.7.3 - Authenticated (Contributor+) Local File Inclusion
Alta
CVE-2026-57791
Brook - Agency Business Creative WordPress Theme <= 2.9.0 - Authenticated (Contributor+) Local File Inclusion
Media
CVE-2026-14306
Tutor LMS <= 3.9.13 - Authenticated (Subscriber+) Information Exposure
Media
CVE-2026-57755
Mosaic Gallery – Advanced Gallery <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Alta
CVE-2026-57790
Billey <= 2.1.8 - Authenticated (Contributor+) Local File Inclusion
Alta
CVE-2026-57804
TheGem Theme Elements <= 5.11.1 - Authenticated (Contributor+) Local File Inclusion
Alta
CVE-2026-13251
Perfmatters <= 2.6.4 - Unauthenticated Arbitrary File Read via 's' Parameter
Alta
CVE-2026-8441
WP Review Slider Pro <= 12.7.2 - Unauthenticated SQL Injection via 'notinstring' Parameter
Alta
CVE-2026-13369
Ninja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter
Media
CVE-2026-9188
Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.6 - Unauthenticated Insecure Direct Object Reference via Predictable 'edit_key' / 'appointmentkey' Parameter
Media
CVE-2026-10104
Product Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameter
Media
CVE-2026-11896
My Calendar <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter
Media
CVE-2026-12657
LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter
Media
CVE-2026-12472
Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters
Media
CVE-2026-12134
JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification via season_groupedit AJAX action
Media
CVE-2026-13459
JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
Media
CVE-2026-11592
Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action
Media
CVE-2026-13704
GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form
Media
CVE-2026-13357
Houzez Property Feed <= 2.5.46 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
Crítica
CVE-2026-15158
Blocksy Companion <= 2.1.46 - Subida no autenticada de archivos arbitrarios a través del parámetro 'blc-review-images[]'
Una vulnerabilidad crítica en Blocksy Companion permite a atacantes no autenticados subir archivos arbitrarios, lo que puede provocar la ejecución remota de código si la versión premium tiene activas extensiones específicas.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.