Media
CVE-2026-104645
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.445
Media
CVE-2026-106596
Visual Composer Website Builder <= 45.16.3 - Missing Authorization
Media
CVE-2026-106603
HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.14 - Unauthenticated Insecure Direct Object Reference
Media
CVE-2026-103072
VillaTheme Core <= 1.0.5 - Missing Authorization
Media
CVE-2026-105078
WP Store Locator <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Alta
CVE-2026-103692
Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation
Media
CVE-2026-105193
Booking Calendar < 11.8 - Unauthenticated Information Exposure
Media
CVE-2026-62127
WP Plugin Info Card <= 6.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Alta
CVE-2026-61439
PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats
Alta
CVE-2026-105642
Ghost: Remote Code Execution via Bookmark Card Images
Alta
CVE-2026-105643
Ghost: Stored XSS via Embed Card Previews
Media
CVE-2026-105644
Ghost : Stored XSS via SVG Files in Content Imports
Media
CVE-2026-105645
Ghost: Regular Expression Denial of Service in External Media Inliner
Media
CVE-2026-105646
Ghost: Regular Expression Denial of Service in Content Import
Media
CVE-2026-106121
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
Media
CVE-2026-105748
Docling: Crafted DoclingDocument JSON embeds local image files into converted output
Crítica
CVE-2026-105697
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
Media
CVE-2026-105698
Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
Alta
CVE-2026-106451
yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user
Baja
CVE-2026-106449
yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError
Media
CVE-2026-106450
yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs
Media
CVE-2026-105647
Ghost: Server-Side Request Forgery in Bookmark Fetching
Media
CVE-2026-105648
Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
Alta
CVE-2026-105649
Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.