Alta
CVE-2026-26801
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.609
Alta
CVE-2026-3231
Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.1.7 - Unauthenticated Stored Cross-Site Scripting via Block Checkout Custom Radio Field
Media
CVE-2026-3492
Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title
Media
CVE-2026-31853
ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder
Media
CVE-2026-30883
ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder
Alta
CVE-2026-30837
Elysia has a string URL format ReDoS
Crítica
CVE-2026-29793
Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
Crítica
CVE-2026-29792
Feathers has an OAuth Callback Account Takeover issue
Media
CVE-2026-28692
ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder
Alta
CVE-2026-1993
ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update
Media
CVE-2026-28689
ImageMagick has a Path Policy TOCTOU symlink race bypass
Alta
CVE-2026-1992
ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation
Alta
CVE-2026-1708
Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter
Media
CVE-2026-2917
Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter
Media
CVE-2026-2918
Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions
Crítica
CVE-2026-27825
MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment
Crítica
CVE-2026-28292
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
Baja
CVE-2026-2741
Vaadin: Specially crafted ZIP archives can escape the intended extraction directory
Media
CVE-2026-2742
Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash
Alta
CVE-2026-26118
Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network
Media
CVE-2026-23907
Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function
Alta
CVE-2025-56421
LimeSurvey is vulnerable to SQL injection
Crítica
CVE-2026-31840
Parse Server: SQL injection via dot-notation field name in PostgreSQL
Media
CVE-2026-31867
Craft Commerce: Potential IDOR in Commerce carts
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.