Media
CVE-2026-54494
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.406
Media
CVE-2026-50552
Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail
Alta
CVE-2026-58659
PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters
Alta
CVE-2026-54491
Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths
Media
ghsa-8q6q-m837-fv64
Koel has SSRF through Authenticated Subsonic podcast feed URLs
Alta
CVE-2026-54493
Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
Media
CVE-2026-54492
Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation
Media
CVE-2026-49280
MantisBT: REST API unauthorized Issue status change
Alta
CVE-2026-49273
MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php
Crítica
CVE-2026-47156
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
Alta
CVE-2026-47142
MantisBT: SQL Injection via history_order Configuration Value
Media
CVE-2026-15458
SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'sort_field' Parameter
Media
CVE-2026-15445
SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
Alta
CVE-2026-13042
RPB Chessboard <= 8.1.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content
Media
CVE-2026-15306
Product Feed Manager For WooCommerce <= 7.6.1 - Reflected Cross-Site Scripting via 's' Search Parameter
Media
CVE-2026-13005
MxChat <= 3.2.10 - Authenticated (Admin+) Stored Cross-Site Scripting via 'intro_message' Setting
Media
CVE-2026-12941
MultiVendorX <= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter
Media
CVE-2026-15652
Easy Accordion <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block Attribute
Media
CVE-2026-15336
Catch Themes Demo Import <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Single Plugin Installation via 'activate_plugin' Parameter
Media
CVE-2026-12434
List category posts <= 0.95.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'post_status' Shortcode Attribute
Media
CVE-2026-12409
Landing Page Builder <= 1.5.3.6 - Cross-Site Request Forgery to ulpb_admin_data AJAX Action
Media
CVE-2026-14987
GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting
Alta
CVE-2026-12753
Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameter
Alta
CVE-2026-12997
Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.