Media
CVE-2026-1823
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.609
Media
CVE-2026-30228
parse-server's file creation and deletion bypasses `readOnlyMasterKey` write restriction
Media
ghsa-9r75-g2cr-3h76
Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens
Media
CVE-2026-1820
Media Library Alt Text Editor <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_id' Shortcode Attribute
Media
CVE-2026-1574
MyQtip – easy qTip2 <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Media
CVE-2026-1569
Wueen <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode
Baja
CVE-2026-30830
defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag
Alta
CVE-2026-30827
express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network
Alta
CVE-2025-15602
Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment
Alta
CVE-2026-29783
GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution
Alta
CVE-2025-8899
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.3.20 - Authenticated (Author+) Privilege Escalation
Media
CVE-2026-1650
MDJM Event Management <= 1.7.8.1 - Missing Authorization to Unauthenticated Arbitrary Custom Event Field Deletion
Media
CVE-2026-2721
MailArchiver <= 4.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
Alta
CVE-2025-14353
ZIP Code Based Content Protection <= 1.0.2 - Unauthenticated SQL Injection via 'zipcode' Parameter
Media
CVE-2026-2429
Community Events <= 1.5.8 - Authenticated (Administrator+) SQL Injection via 'ce_venue_name' CSV Field
Alta
CVE-2026-2020
JS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection via 'included' Shortcode Attribute
Media
CVE-2026-2488
ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion
Media
CVE-2026-2494
ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial
Media
CVE-2026-2431
CM Custom Reports <= 1.2.7 - Reflected Cross-Site Scripting via 'date_from' and 'date_to' Parameters
Media
CVE-2026-2722
Stock Ticker <= 3.26.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Template
Alta
CVE-2026-3352
Easy PHP Settings <= 1.0.4 - Authenticated (Administrator+) PHP Code Injection via 'wp_memory_limit' Setting
Media
CVE-2026-1902
Hammas Calendar <= 1.5.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'apix' Shortcode Attribute
Media
CVE-2026-1644
WP Frontend Profile <= 1.3.8 - Cross-Site Request Forgery to Unauthorized User Account Approval or Rejection
Media
CVE-2026-2371
Greenshift <= 12.8.3 - Missing Authorization to Unauthenticated Private Reusable Block Disclosure via 'gspb_el_reusable_load'
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.