Vulnerabilidades CVE

A continuación la lista de las últimas vulnerabilidades publicadas por el instituto NIST:

Borrar filtros
CVE ID Publicado Severidad CVSS Descripción
CVE-2026-65926 2026-08-12 LOW 3.1 An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.
CVE-2026-48550 2026-08-12 MEDIUM 6.1 Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a…
CVE-2026-16999 2026-08-12 MEDIUM 6.3 Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17…
CVE-2026-15803 2026-08-12 N/A 0.0 In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE…
CVE-2026-73432 2026-08-12 N/A 0.0 Vulnerability-Lookup contains a server-side request forgery (SSRF) vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the…
CVE-2026-73327 2026-08-12 HIGH 7.6 Joomla 6.1.1 contains a path traversal vulnerability in the com_joomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences…
CVE-2026-73431 2026-08-12 N/A 0.0 Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although…
CVE-2026-73405 2026-08-12 N/A 0.0 An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events (SSE) streams through the /pubsub/subscribe/ endpoint. The token_required decorator used by the…
CVE-2026-73374 2026-08-12 N/A 0.0 A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references[].tags[] were directly…
CVE-2026-65938 2026-08-12 MEDIUM 4.3 In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions.
CVE-2026-66380 2026-08-12 MEDIUM 4.3 An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
CVE-2026-49467 2026-08-12 HIGH 8.8 Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing…
CVE-2026-48554 2026-08-12 HIGH 7.5 Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification…
CVE-2026-44741 2026-08-12 HIGH 8.8 Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter —…
CVE-2026-42018 2026-08-12 HIGH 7.5 JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
CVE-2026-18634 2026-08-11 HIGH 8.4 An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with…
CVE-2026-18171 2026-08-12 N/A 0.0 Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's…
CVE-2026-18046 2026-08-12 MEDIUM 4.3 The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so…
CVE-2026-18035 2026-08-12 MEDIUM 5.3 The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages…
CVE-2026-9318 2026-08-12 MEDIUM 5.4 tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset…
CVE-2026-73297 2026-08-12 N/A 0.0 Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, _is_blocked_ip in ufo/utils/url_security.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix…
CVE-2026-73295 2026-08-12 MEDIUM 5.4 Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability…
CVE-2026-73294 2026-08-12 CRITICAL 9.9 Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories…
CVE-2026-73293 2026-08-12 HIGH 8.8 Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST…
CVE-2026-73122 2026-08-12 HIGH 7.7 A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent from a managed cluster to gain unauthorized…
CVE-2026-71468 2026-08-11 MEDIUM 5.3 A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache…
CVE-2026-72742 2026-08-11 HIGH 8.6 DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local…
CVE-2026-68755 2026-08-12 MEDIUM 4.3 A bundle writer may create misleading release promotion information under specific conditions.
CVE-2026-68754 2026-08-12 MEDIUM 6.5 A repository publisher without delete permission may modify protected package content under specific conditions.
CVE-2026-68753 2026-08-12 MEDIUM 5.3 An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
CVE-2026-65941 2026-08-12 HIGH 8.8 In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application…
CVE-2026-65940 2026-08-12 MEDIUM 6.8 In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.
CVE-2026-66376 2026-08-12 MEDIUM 4.2 Credentials for a deleted user may remain valid for a short period under specific conditions.
CVE-2026-64927 2026-08-12 MEDIUM 6.4 A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across…
CVE-2026-48552 2026-08-12 MEDIUM 5.4 Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into…
CVE-2026-48551 2026-08-12 HIGH 7.4 Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and…
CVE-2026-19548 2026-08-12 MEDIUM 5.5 Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c…
CVE-2026-19217 2026-08-12 MEDIUM 5.4 The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users…
CVE-2026-29035 2026-08-11 MEDIUM 6.5 CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames…
CVE-2026-18230 2026-08-12 HIGH 8.1 The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX…
CVE-2026-18057 2026-08-12 HIGH 8.1 The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account…
CVE-2026-18049 2026-08-12 HIGH 7.5 The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option…
CVE-2026-17013 2026-08-12 MEDIUM 6.1 The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated…
CVE-2026-16977 2026-08-12 HIGH 8.1 The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed…
CVE-2025-41770 2026-08-12 HIGH 7.5 An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the…
CVE-2026-16253 2026-08-12 HIGH 7.5 The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose…
CVE-2026-16066 2026-08-12 MEDIUM 5.4 The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role…
CVE-2026-15249 2026-08-12 MEDIUM 5.4 The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as…
CVE-2026-15426 2026-08-11 HIGH 8.8 The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,…
CVE-2024-14042 2026-08-11 MEDIUM 6.3 A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss_ogs_diam_s6a_air_cb/hss_ogs_diam_s6a_ulr_cb of the file src/hss/hss-s6a-path.c of the component Diameter S6a Interface. Performing a manipulation of…
« Anterior Página 43 de 4839 Siguiente »