Media
CVE-2026-40935
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.593
Media
CVE-2026-40929
WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators
Media
CVE-2026-40928
WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion
Alta
CVE-2026-40926
WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)
Alta
CVE-2026-40925
WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
Crítica
CVE-2026-40911
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
Alta
CVE-2026-40909
WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)
Media
CVE-2026-40908
WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version
Media
CVE-2026-40907
WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens
Crítica
CVE-2026-40887
@vendure/core has a SQL Injection vulnerability
Media
CVE-2026-40104
XWiki's REST APIs can list all pages/spaces, leading to unavailability
Media
CVE-2026-40105
XWiki has Reflected Cross-Site Scripting (XSS) in page history compare
Alta
CVE-2026-39971
Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header
Media
CVE-2026-39963
Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php
Alta
CVE-2026-39884
MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting
Crítica
CVE-2026-39842
Expression Injection in OpenRemote
Media
CVE-2026-25133
October Rain has Stored XSS via SVG Filter Bypass
Media
CVE-2026-25125
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
Baja
CVE-2026-7808
Multiple security fixes in justhtml
Alta
CVE-2026-40176
Composer has a command injection via malicious perforce repository
Media
CVE-2026-24907
October CMS has Stored XSS in Event Log Mail Preview
Media
CVE-2026-24906
October CMS has Stored XSS in Backend Editor Markup Classes
Media
CVE-2026-22692
October Rain has a Twig Sandbox Bypass via Collection Methods
Alta
CVE-2026-40261
Composer has a command injection via malicious perforce reference
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.