Alta
CVE-2026-56827
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 620
Restablecer filtros
Media
CVE-2026-82396
Sulu: Stored XSS via media download inline-disposition override
Alta
CVE-2026-64850
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Media
CVE-2026-62237
Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
Alta
CVE-2026-81891
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
Alta
CVE-2026-86431
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
Alta
CVE-2026-86430
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
Alta
CVE-2026-55843
Snipe-IT has an Improper Privilege Management issue
Media
CVE-2026-55696
PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction
Crítica
CVE-2026-55634
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
Crítica
CVE-2026-55220
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
Alta
CVE-2026-55208
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
Media
CVE-2026-55481
Snipe-IT has CSS Injection via `header_color` Setting
Media
CVE-2026-55466
Snipe-IT vulnerable to stored XSS via inline-served attachment
Media
CVE-2026-55452
Snipe-IT has CSV formula injection in Activity Report export
Alta
CVE-2026-54718
silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template
Alta
CVE-2026-54721
silverstripe/userforms vulnerable to remote code execution via userforms email subject
Alta
CVE-2026-84192
LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates
Media
CVE-2026-57994
phpMyFAQ public FAQ APIs expose inactive FAQ content
Alta
CVE-2026-63135
YOURLS has stored XSS in referrer statistics chart via crafted Referer header
Media
CVE-2026-86197
Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin
Media
ghsa-hq84-x37p-j6q5
Winter: Reflected XSS through the search query parameter in the backend Table widget
Media
ghsa-5cwr-5jxg-pcf6
Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
Baja
ghsa-7mpf-4465-7fc2
Winter: Stored XSS through Backend List widget image columns
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.