Alta
ghsa-2mhw-8qcg-gr96
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.602
Media
CVE-2026-33311
SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials
Alta
CVE-2026-33228
Prototype Pollution via parse() in NodeJS flatted
Media
CVE-2026-33297
AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php
Baja
CVE-2026-33296
AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php
Alta
CVE-2026-33295
AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php
Media
CVE-2026-33294
AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources
Alta
CVE-2026-33293
AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
Alta
CVE-2026-33292
AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos
Alta
CVE-2026-32935
phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack
Crítica
CVE-2026-4038
Aimogen Pro <= 2.7.5 - Unauthenticated Privilege Escalation via Arbitrary Function Call
Media
CVE-2026-4136
Membership Plugin – Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirect
Crítica
ghsa-wvr4-3wq4-gpc5
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint
Media
CVE-2026-56346
AVideo has Unauthenticated PGP Message Decryption via Public Endpoint
Media
CVE-2026-33319
AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command
Media
CVE-2026-33238
AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration
Media
CVE-2026-33237
AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation
Alta
CVE-2026-33068
Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File
Media
CVE-2025-15363
Get Use APIs – JSON Content Importer < 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Media
CVE-2026-39562
Client Invoicing by Sprout Invoices <= 20.8.10 - Missing Authorization
Media
CVE-2026-39521
Nelio Content <= 4.3.1 - Authenticated (Contributor+) Server-Side Request Forgery
Alta
CVE-2025-14545
YML for Yandex Market < 5.0.26 - Authenticated (Shop Manager+) Remote Code Execution
Alta
CVE-2026-3658
Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter
Baja
CVE-2026-32722
Stored XSS in Memray-generated HTML reports via unescaped command-line metadata
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.