Media
CVE-2026-75018
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.445
Media
CVE-2026-74853
Pods – Custom Content Types and Fields 3.3 - 3.3.9.1 - Authenticated (Author+) Arbitrary File Read
Media
CVE-2026-85038
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More < 5.2.40 - Unauthenticated Unauthorized B2B Group Assignment
Media
CVE-2026-17517
Content Views – Post Grid & Filter (Shortcode, Blocks, Elementor Widgets) < 4.5.1.2 - Missing Authorization
Media
CVE-2026-79631
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Unauthenticated Information Exposure
Media
CVE-2026-87870
Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters
Media
CVE-2026-32480
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.11 - Missing Authorization
Crítica
CVE-2026-10196
Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields
Media
CVE-2026-84066
Directorist: AI-Powered Business Directory, Listings & Classified Ads < 8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
Media
CVE-2026-12843
LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint
Media
CVE-2026-57777
WooCommerce <= 10.9.4 - Authenticated (Shop Manager+) SQL Injection
Alta
CVE-2026-19224
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN < 3.21.2 - Authenticated (Administrator+) Remote Code Execution
Media
CVE-2025-15691
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Missing Authorization
Media
CVE-2026-27086
Woodmart < 8.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Media
CVE-2026-82186
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode < 4.4.2 - Authenticated (Administrator+) SQL Injection
Crítica
CVE-2024-33663
python-jose algorithm confusion guard bypassed by DER-encoded public keys
Alta
CVE-2026-77465
toml-node: Uncontrolled Recursion
Alta
CVE-2026-63376
toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
Media
CVE-2026-71429
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
Media
CVE-2026-63670
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
Media
CVE-2026-63669
ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
Alta
CVE-2026-82404
TOON: Prototype pollution when decoding untrusted TOON input
Alta
CVE-2026-73222
Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)
Crítica
CVE-2026-62681
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.