Explotadas, aún no en el catálogo de CISA
138 fallos explotados y aún no oficiales
Estas vulnerabilidades tienen pruebas públicas de explotación pero todavía no están en el catálogo de CISA. No traen un plazo legal: traen pruebas. Cuando CISA llega, lo hace una mediana de 20 días después.
- CVE-2021-2109vista por sensoresno está en el catálogo de CISA
Oracle · WebLogic Server
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP
Fuentes: dashboard.shadowserver.org
- CVE-2016-5312vista por sensoresno está en el catálogo de CISA
Symantec · messaging_gateway
Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the sn parameter to brightmail/servlet/com.ve.kavachart.servlet.ChartStream.
Fuentes: dashboard.shadowserver.org
- CVE-2026-45298vista por sensoresno está en el catálogo de CISA
amirraminfar · dozzle
Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy (the documented quickstart, no DOZZLE_AUTH_PROVIDER set), POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that
Fuentes: dashboard.shadowserver.org · kevintel.com
- CVE-2025-55583no está en el catálogo de CISA
D-Link · dir-868l_firmware
D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly to system-level shell execution functions without sanitizati
Fuentes: fortinet.com
- CVE-2025-10123no está en el catálogo de CISA
D-Link · dir-823x_firmware
A vulnerability was determined in D-Link DIR-823X up to 250416. Affected by this vulnerability is the function sub_415028 of the file /goform/set_static_leases. Executing manipulation of the argument Hostname can lead to command injection. The attack can be launched remotely. The exploit has been pu
Fuentes: fortinet.com
- CVE-2024-58374HIGH7.5no está en el catálogo de CISA
Hongjing Century · e-HR
Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attackers
Fuentes: cve.org
- CVE-2020-9771no está en el catálogo de CISA
Apple · MacOS X
This issue was addressed with a new entitlement. This issue is fixed in macOS Catalina 10.15.4. A user may gain access to protected parts of the file system.
Fuentes: jamf.com
- CVE-2019-25765HIGH7.5no está en el catálogo de CISA
ASP-CMS Project · ASP-CMS
ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by interleaving
Fuentes: kevintel.com · cve.org
Microsoft · SharePoint
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
Fuentes: cydome.io · kevintel.com · x.com
- CVE-2022-50997no está en el catálogo de CISA
Weaver Network Co., Ltd. · E-cology 9.0
Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET request
Fuentes: kevintel.com · cve.org
- CVE-2016-20097HIGH7.5no está en el catálogo de CISA
Weaver Network Co., Ltd. · E-cology 8.0
Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers c
Fuentes: kevintel.com · cve.org
- CVE-2026-66443HIGH7.5no está en el catálogo de CISA
Pete Nelson · REST API Log
Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.
Fuentes: patchstack.com
- CVE-2026-66441HIGH7.5no está en el catálogo de CISA
MultiVendorX · MultiVendorX
Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.
Fuentes: patchstack.com
- CVE-2026-48294no está en el catálogo de CISA
Adobe · Acrobat and Reader
Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in that
Fuentes: watchguard.com
Apple · macos
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.
Fuentes: advisories.ncsc.nl · ncsc.nl
- CVE-2026-2652vista por sensoresno está en el catálogo de CISA
lfprojects · mlflow
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gate
Fuentes: dashboard.shadowserver.org · crowdsec.net · kevintel.com
- CVE-2026-15459HIGH8.1no está en el catálogo de CISA
wpmudev · WPMU DEV Dashboard
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the signa
Fuentes: patchstack.com
- CVE-2018-14013vista por sensoresno está en el catálogo de CISA
Synacor · Zimbra Collaboration Suite (ZCS)
Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.
Fuentes: dashboard.shadowserver.org · kevintel.com
- CVE-2026-66665CRITICAL10.0no está en el catálogo de CISA
Brandexponents · Type Hub
Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.
Fuentes: patchstack.com
- CVE-2026-16144HIGH8.1no está en el catálogo de CISA
kaliforms · contact_form_builder
The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callabl
Fuentes: patchstack.com
- CVE-2026-28409vista por sensoresno está en el catálogo de CISA
wegia · wegia
WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution (RCE) vulnerability exists in the WeGIA application's database restoration functionality. An attacker with administrative access (which can be obtained via the previously reported Authenticat
Fuentes: dashboard.shadowserver.org · kevintel.com
- CVE-2026-28139CRITICAL9.8no está en el catálogo de CISA
wpdreams · Ajax Search Lite
Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.
Fuentes: patchstack.com
- CVE-2026-65442HIGH7.2no está en el catálogo de CISA
Subtle Web Inc · FormCraft
Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.
Fuentes: patchstack.com
- CVE-2026-54066vista por sensoresno está en el catálogo de CISA
b3log · siyuan
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the /export/ route but the identical root cause remains in the /assets/*path route. In publish mode (anonymous read-only HTTP endpoint, def
Fuentes: dashboard.shadowserver.org · kevintel.com
- CVE-2026-38992vista por sensoresno está en el catálogo de CISA
agentejo · cockpit
Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.
Fuentes: dashboard.shadowserver.org · kevintel.com
- CVE-2025-71324vista por sensoresno está en el catálogo de CISA
FlowiseAI · Flowise
Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed witho
Fuentes: dashboard.shadowserver.org · kevintel.com
- CVE-2023-54359vista por sensoresno está en el catálogo de CISA
Adivaha · WordPress adivaha Travel Plugin
WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid' value
Fuentes: dashboard.shadowserver.org · kevintel.com
- CVE-2023-2825vista por sensoresno está en el catálogo de CISA
GitLab · gitlab
An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.
Fuentes: dashboard.shadowserver.org · kevintel.com
- CVE-2026-73533CRITICAL9.8no está en el catálogo de CISA
WPManageNinja · Ninja Tables Pro
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, d
Fuentes: kevintel.com · cve.org · wpmanageninja.com
- CVE-2026-73532CRITICAL9.8no está en el catálogo de CISA
WPManageNinja · Fluent Forms Pro
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php,
Fuentes: cve.org · patchstack.com · wpmanageninja.com
- CVE-2026-53576vista por sensoresno está en el catálogo de CISA
kestra · kestra
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addre
Fuentes: api.vulncheck.com
- CVE-2026-48313vista por sensoresno está en el catálogo de CISA
Adobe · ColdFusion
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive fil
Fuentes: dashboard.shadowserver.org · kevintel.com · crowdsec.net
- CVE-2026-3836vista por sensoresno está en el catálogo de CISA
Linux · dnf5
A local, unprivileged attacker can exploit a path traversal flaw in the D-Bus locale configuration, crashing dnf5daemon-server via a crafted string. This can lead to a DoS with a core dump.
Fuentes: dashboard.shadowserver.org
litellm · litellm
LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.
Fuentes: api.vulncheck.com
Microsoft · Windows
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
Fuentes: tenable.com · recordedfuture.com · unit42.paloaltonetworks.com
- CVE-2026-67595HIGH8.1no está en el catálogo de CISA
webreinvent · vaahcms
VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript enabled.
Fuentes: kevintel.com · cve.org
- CVE-2026-65885HIGH8.8no está en el catálogo de CISA
balbooa.com · Gridbox extension for Joomla
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.
Fuentes: mysites.guru
- CVE-2026-65884CRITICAL9.8no está en el catálogo de CISA
balbooa.com · Gridbox extension for Joomla
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions.
Fuentes: mysites.guru
- CVE-2026-58138vista por sensoresno está en el catálogo de CISA
netflix · conductor
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to au
Fuentes: api.vulncheck.com
- CVE-2026-59553HIGH7.1no está en el catálogo de CISA
RexTheme · Product Feed Manager
Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.
Fuentes: patchstack.com
- CVE-2026-8496MEDIUM6.1no está en el catálogo de CISA
Alinto SOGo · SOGo
A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content embedded in the description field of an ICS
Fuentes: proofpoint.com
alibaba · fastjson
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
Fuentes: recordedfuture.com · webflow.sysdig.com · kevintel.com · threatbook.io
- CVE-2025-62631no está en el catálogo de CISA
Fortinet · FortiOS
An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password
Fuentes: levelblue.com
- CVE-2026-44825no está en el catálogo de CISA
Apache · Solr
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specifie
Fuentes: research.empiricalsecurity.com
- CVE-2026-58455vista por sensoresno está en el catálogo de CISA
Notifiarr · dockwatch
Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit() after an authentication redirect in loader.php combined with unsanitized input passed to shell_exec() in ajax/compo
Fuentes: api.vulncheck.com
- CVE-2026-4480no está en el catálogo de CISA
Red Hat · openshift_container_platform
A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sen
Fuentes: hunt.io
- CVE-2025-68493vista por sensoresno está en el catálogo de CISA
Apache · Struts
Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.
Fuentes: dashboard.shadowserver.org
- CVE-2016-4800no está en el catálogo de CISA
eclipse · jetty
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.
Fuentes: f5.com
- CVE-2007-6672no está en el catálogo de CISA
mortbay_jetty · jetty
Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) characters in the URI.
Fuentes: f5.com
- CVE-2005-0869no está en el catálogo de CISA
phpsysinfo · phpsysinfo
phpSysInfo 2.3 allows remote attackers to obtain sensitive information via a direct request to (1) class.OpenBSD.inc.php, (2) class.NetBSD.inc.php, (3) class.FreeBSD.inc.php, (4) class.Darwin.inc.php, (5) XPath.class.php, (6) system_header.php, or (7) system_footer.php, which reveal the path in a PH
Fuentes: f5.com
- CVE-2026-6875no está en el catálogo de CISA
ServiceNow · ServiceNow AI Platform
ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform. ServiceNow addressed this vulnerability by deploying
Fuentes: recordedfuture.com · kevintel.com · x.com
- CVE-2026-29059vista por sensoresno está en el catálogo de CISA
windmill · windmill
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's get_log_file endpoint "(/api/w/{workspace}/jobs_u/get_log_file/{filename})". The filename paramete
Fuentes: api.vulncheck.com · recordedfuture.com · kevintel.com · linkedin.com
- CVE-2016-0638no está en el catálogo de CISA
Oracle · WebLogic Server
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Messaging Service.
Fuentes: blog.xlab.qianxin.com
- CVE-2026-9282no está en el catálogo de CISA
boldgrid · w3_total_cache
The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Fuentes: patchstack.com
- CVE-2026-14894no está en el catálogo de CISA
WebRehab · Super Forms – Drag & Drop Form Builder
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handle
Fuentes: patchstack.com
- CVE-2026-45586no está en el catálogo de CISA
Microsoft · Windows
Improper link resolution before file access ('link following') in Windows Collaborative Translation Framework allows an authorized attacker to elevate privileges locally.
Fuentes: recordedfuture.com
- CVE-2026-44963no está en el catálogo de CISA
Veeam · veeam_backup_\&_replication
A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.
Fuentes: recordedfuture.com
- CVE-2026-2699vista por sensoresno está en el catálogo de CISA
Progress · sharefile_storage_zones_controller
Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.
Fuentes: dashboard.shadowserver.org
- CVE-2020-17103no está en el catálogo de CISA
Microsoft · Windows
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Fuentes: recordedfuture.com
- CVE-2026-3395no está en el catálogo de CISA
max-3000 · maxsite_cms
A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code injection. It is possible to launch the attack re
Fuentes: recordedfuture.com · cyber.gov.au
- CVE-2026-31843CRITICAL9.8no está en el catálogo de CISA
goodoneuz · pay-uz
The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remot
Fuentes: recordedfuture.com · cyber.gov.au
- CVE-2025-7852no está en el catálogo de CISA
iqonic · wpbookit
The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_new_customer' route in all versions up to, and including, 1.0.6. The plugin’s image‐upload handler calls move_uploaded_file() on cli
Fuentes: recordedfuture.com · socradar.io · cyber.gov.au
- CVE-2026-4631vista por sensoresno está en el catálogo de CISA
GNU · grub2
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options
Fuentes: dashboard.shadowserver.org
- CVE-2026-59800vista por sensoresno está en el catálogo de CISA
decolua · 9router
9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to th
Fuentes: dashboard.shadowserver.org · kevintel.com · cve.org
- CVE-2020-22658no está en el catálogo de CISA
ruckuswireless · r310_firmware
In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Vir
Fuentes: recordedfuture.com · blog.talosintelligence.com
- CVE-2020-22653no está en el catálogo de CISA
ruckuswireless · r310_firmware
In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Vir
Fuentes: recordedfuture.com · blog.talosintelligence.com
- CVE-2026-20896no está en el catálogo de CISA
Gitea · Gitea Open Source Git Server
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.
Fuentes: csa.gov.sg · linkedin.com
- CVE-2023-39361vista por sensoresno está en el catálogo de CISA
Cacti · Cacti
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an enabled state, there co
Fuentes: dashboard.shadowserver.org
- CVE-2026-58480no está en el catálogo de CISA
Creative Themes · Blocksy Companion
Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exp
Fuentes: cve.org · patchstack.com
- CVE-2026-5524no está en el catálogo de CISA
Divi Engine · Divi Form Builder
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do_image_upload() function where user-supplied input from the acceptFileTypes POS
Fuentes: patchstack.com
- CVE-2026-1125vista por sensoresno está en el catálogo de CISA
D-Link · dir-823x_firmware
A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_wifidog_settings. Executing a manipulation of the argument wd_enable can lead to command injection. The attack can be executed remotely. The exploit has been made avail
Fuentes: dashboard.shadowserver.org · kevintel.com
- CVE-2024-58352no está en el catálogo de CISA
Shenzhen Landray Software Co., Ltd. · Landry Office Automation (OA)
Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input sanitizatio
Fuentes: cve.org
- CVE-2024-14037no está en el catálogo de CISA
Guangzhou Red Sea Cloud Computing Co., Ltd. · Red Sea Cloud eHR
Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading malicious files through the PtFjk.mob servlet endpoint. Attackers can submit a multipart POST request with a JSP webshell disguised using a spoofed ima
Fuentes: cve.org
- CVE-2022-50973no está en el catálogo de CISA
Yonyou Network Technology Co., Ltd. · KSOA
Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any authentication
Fuentes: cve.org
- CVE-2026-8451vista por sensoresno está en el catálogo de CISA
Citrix · NetScaler ADC and NetScaler Gateway
Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML IDP
Fuentes: crowdsec.net · kevintel.com · lupovis.io
- CVE-2026-57624no está en el catálogo de CISA
Creative Themes · Blocksy Companion Pro
Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.
Fuentes: patchstack.com
- CVE-2026-13731no está en el catálogo de CISA
quantumcloud · wpbot
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.4.9 due to insufficient input sanitization and output escaping. This makes it possible for
Fuentes: patchstack.com
- CVE-2018-8007no está en el catálogo de CISA
Apache · CouchDB
Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user tha
Fuentes: blog.xlab.qianxin.com
- CVE-2026-52806no está en el catálogo de CISA
gogs · gogs
Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before mer
Fuentes: threats.wiz.io
- CVE-2026-8054vista por sensoresno está en el catálogo de CISA
dotCMS · dotCMS Core
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attackers to read, modify, or destroy arbitra
Fuentes: dashboard.shadowserver.org · kevintel.com
Por qué una página aparte
Datos del catálogo Known Exploited Vulnerabilities de CISA, obra del Gobierno de EE. UU. en dominio público. Los plazos indicados obligan a las agencias federales estadounidenses (BOD 22-01); para el resto son una buena referencia de prioridad.
Datos de explotación: VulnCheck KEV. El catálogo de vulnerabilidades explotadas activamente es de CISA.