CVE Watch402,574 en archivo total

Vulnerabilidades explotables hoy

15,732en la vista actual

Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.

En catálogo KEV1,756

Nuevos KEV · 24H0

Exploit Today ≥ 701,689

Distribución · última ventana

Crítico
4,546
Alto
18,445
Medio
17,035
Bajo
1,709

Filtros

Ventana

Severidad

Filtros

Vulnerabilidades14,001–14,040 · 15,732

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-765709.1 CRÍ

39.6%

——12Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.19d CVE-2026-1033975.6 MED

12.3%

——4OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations.23d CVE-2026-1032435.8 MED

23.6%

——7LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error responses revealing internal network topology.23d CVE-2026-1032276.3 MED

31.7%

——10A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools/dash_client.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version abi-16.26 can resolve this issue. Patch name: 4c8e26f278ff63eec57968f7bc696f604bb0cffd. It is recommended to upgrade the affected component.23d CVE-2026-1032266.3 MED

24.6%

——7A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."10d CVE-2026-1031184.3 MED

21.7%

——7A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.23d CVE-2026-973025.3 MED

8.7%

——3Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.25d CVE-2026-973016.5 MED

5.8%

——2Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.2d CVE-2026-972995.4 MED

0.6%

——0Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.25d CVE-2026-972986.5 MED

2.3%

——1Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.25d CVE-2026-972938.5 ALT

15.2%

——5Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.25d CVE-2026-972926.5 MED

2.3%

——1Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.25d CVE-2026-972897.1 ALT

3.5%

——1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.16d CVE-2026-972886.5 MED

2.3%

——1Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.25d CVE-2026-972878.5 ALT

16.4%

——5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.11d CVE-2026-972866.5 MED

8.0%

——2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.23d CVE-2026-972855.4 MED

9.8%

——3Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.25d CVE-2026-972825.3 MED

6.4%

——2Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.25d CVE-2026-972796.5 MED

4.1%

——1Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.25d CVE-2026-972749.8 CRÍ

21.6%

——6Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.25d CVE-2026-972727.1 ALT

3.5%

——1Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.25d CVE-2026-972717.1 ALT

3.5%

——1Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.25d CVE-2026-972706.5 MED

5.8%

——2Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.25d CVE-2026-972674.3 MED

11.5%

——3Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.25d CVE-2026-972666.5 MED

2.3%

——1Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.25d CVE-2026-972626.5 MED

2.3%

——1Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.25d CVE-2026-972615.3 MED

8.7%

——3Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.25d CVE-2026-972537.1 ALT

3.5%

——1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.25d CVE-2026-972507.1 ALT

3.5%

——1Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.25d CVE-2026-972495.3 MED

8.7%

——3Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.25d CVE-2026-972489.8 CRÍ

31.2%

——9Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.25d CVE-2026-972476.5 MED

10.2%

——3Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.25d CVE-2026-972464.9 MED

10.8%

——3Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Object Injection.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.5.5d CVE-2026-972457.2 ALT

26.2%

——8Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.25d CVE-2026-972447.5 ALT

21.2%

——6Contributor Path Traversal in Creator LMS <= 1.2.19 versions.25d CVE-2026-972435.4 MED

12.5%

——4Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.25d CVE-2026-972426.8 MED

28.4%

——9Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.25d CVE-2026-972417.5 ALT

21.8%

——7Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.25d CVE-2026-972407.5 ALT

21.8%

——7Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.25d CVE-2026-972396.5 MED

20.2%

——6Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.25d