Media
CVE-2026-84835
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.529
Alta
CVE-2026-84773
EWWW Image Optimizer <= 8.7.6 - Unauthenticated Stored Cross-Site Scripting
Alta
CVE-2026-84812
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.15.27 - Unauthenticated Stored Cross-Site Scripting
Media
CVE-2026-75134
SEOWriting <= 1.12.5 - Authenticated (Contributor +) Stored Cross-Site Scripting
Media
CVE-2026-84756
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.11 - Authenticated (Subscriber+) Privilege Escalation
Media
CVE-2026-84781
Gallery PhotoBlocks <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Media
CVE-2026-84771
PublishPress Permissions: Access Control, Content Permissions, User Access <= 4.8.3 - Unauthenticated Insecure Direct Object Reference
Alta
CVE-2026-84761
LiteSpeed Cache <= 7.9 - Unauthenticated Server-Side Request Forgery
Media
CVE-2026-82194
WPvivid — Backup, Migration & Staging < 0.9.134 - Authenticated (Administrator+) Arbitrary File Deletion
Media
CVE-2026-81427
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors < 2.7.2.1 - Authenticated (Custom Role+) Insecure Direct Object Reference
Alta
CVE-2026-19418
TYPO3 CMS - Broken Access Control in Backend and Install Tool
Media
CVE-2026-84306
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
Baja
CVE-2026-84307
Filament: Password validity disclosure for accounts denied panel access on login page
Alta
CVE-2026-77567
Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled
Media
CVE-2026-84371
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
Alta
CVE-2026-86428
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
Alta
CVE-2026-86429
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
Alta
CVE-2026-86431
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
Alta
CVE-2026-86430
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
Media
CVE-2026-91990
tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
Baja
CVE-2026-91991
Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`
Alta
CVE-2026-73086
nanoid: Integer Overflow or Wraparound
Alta
CVE-2026-101043
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
Media
CVE-2025-7963
Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.