Vulnerabilidades explotables hoy
15,681en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,756
Nuevos KEV · 24H0
Exploit Today ≥ 701,689
Distribución · última ventana
- Crítico4,537
- Alto18,435
- Medio17,025
- Bajo1,707
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-935127.1 ALT6.9%
——2Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.25dCVE-2026-928994.8 MED43.1%
——13Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticated request could re-send it with a space added to the Nonce: the password digest still verified, but the token no longer matched the remembered one, so the replay was accepted. Since a UsernameToken does not cover the message body, the captured token could then be reused on requests of the attacker's choosing until it expired. Affects deployments with a nonce replay cache configured, as Apache CXF has by default, and only tokens using a password digest. The cache is now keyed on the decoded Nonce. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.23dCVE-2026-921217.5 ALT45.6%
——14In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of the message. A policy requiring the SOAP Body to be signed is then satisfied even when the Body carries no signature, removing the protection against XML Signature Wrapping. Signature verification itself is unaffected. The DOM code is not affected.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4 which fix this issue.19dCVE-2026-892389.1 CRÍ26.1%
——8WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.19dCVE-2026-867785.3 MED15.0%
——4Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account Footprinting.
This issue affects Maksisoft Gym: from 0.5.10 before 0.5.11.25dCVE-2026-765049.8 CRÍ98.6%
KEV—80Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability23dCVE-2026-74865—31.7%
——10sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account.
This issue was fixed in version 5.8.0~ynh9.25dCVE-2026-74864—34.6%
——10sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, including a privileged user, without providing a password.
This issue was fixed in version 5.8.0~ynh9.25dCVE-2026-620857.6 ALT23.8%
——7Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.25dCVE-2026-620835.4 MED14.1%
——4Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.25dCVE-2026-620815.4 MED11.0%
——3Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.25dCVE-2026-620806.5 MED6.8%
——2Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.25dCVE-2026-620796.5 MED6.8%
——2Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.25dCVE-2026-620786.5 MED4.7%
——1Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.25dCVE-2026-273717.1 ALT6.9%
——2Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.25dCVE-2026-270852.7 BAJ13.3%
——4Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions.25dCVE-2026-103321—29.5%
——9MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.
The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string concatenation, allowing a crafted value to break out of the attribute context and inject arbitrary script.
Preconditions:
- An authenticated MISP user with the ability to create or modify an event graph entry.
- A second user (the victim) who views the event graph and triggers the preview popover.
Impact:
- Execution of arbitrary JavaScript in the victim's browser within the MISP application context.
- Potential theft of session tokens, cookies, or sensitive data accessible to the victim's browser.
- Potential for performing actions on behalf of the victim within the MISP application.
Affected: MISP versions prior to the fix (commit applied after v2.5.48).25dCVE-2026-1031174.7 MED17.8%
——5A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.25dCVE-2026-1031166.3 MED16.2%
——5A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LO_sort causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.25dCVE-2026-1031156.3 MED16.2%
——5A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.23dCVE-2026-1023995.4 MED1.0%
——0Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.25dCVE-2026-1023987.1 ALT6.9%
——2Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.25dCVE-2026-1023967.1 ALT6.9%
——2Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.25dCVE-2026-1023957.1 ALT6.9%
——2Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.25dCVE-2026-1023866.5 MED10.4%
——3Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions.25dCVE-2026-1023857.1 ALT6.9%
——2Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.25dCVE-2026-1023845.9 MED8.2%
——2Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.25dCVE-2026-1005136.5 MED4.7%
——1Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions.25dCVE-2026-1005085.3 MED24.4%
——7Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.25dCVE-2026-1005077.1 ALT6.9%
——2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.10.1.19dCVE-2026-889209.8 CRÍ47.6%
——14An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.23dCVE-2026-878309.1 CRÍ12.1%
——4In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.19dCVE-2026-855327.5 ALT45.7%
——14Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum length of 512 bytes, and a maximum offset of 4096 bytes.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.23dCVE-2026-621467.8 ALT6.1%
——2A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape.25dCVE-2026-10739—2.1%
——1Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.25dCVE-2026-10726—0.0%
——0Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.25dCVE-2026-1032427.1 ALT1.8%
——1A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.25dCVE-2026-1031146.3 MED9.8%
——3A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of the argument Tables leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.25dCVE-2026-103012—1.0%
——0Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated with the Enterprise or Team account. When the settings endpoint rejected that stored key, the session started without the organization's server-managed policy (such as permission deny rules, model restrictions and managed-only locks) or, if a previously cached copy existed on the machine, kept applying that stale copy without receiving later policy changes — while continuing to operate as the organization's account. Triggering this required local access to a device with such a stored API key; the no-policy case additionally required that no managed settings had previously been cached. Endpoint-managed (MDM or file-based) settings were not affected. Claude for Enterprise organizations were affected from version 2.0.68; Claude for Work (Team) organizations from version 2.1.38, when server-managed settings became available to them.
Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to version 2.1.260 or later.
Thank you to Tamas Voros / NVIDIA AI Red Team for reporting this issue.25dCVE-2026-96342—14.9%
——4Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83.25d