Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2882▼ 181 respecto a la semana anterior

Críticas / altas1279▼ 60 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)487▼ 22 respecto a la semana anterior

41 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-28134	Aplazada	Alta (8.5)	0.40%	—	Crocoblock Jetengine^AI	5/3/2026	17/6/2026	Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through <= 3.7.2.
CVE-2025-68495	Aplazada	Alta (7.1)	0.19%	—	Crocoblock Jetengine^AI	20/2/2026	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.8.0.
CVE-2025-67923	Aplazada	Alta (7.1)	0.29%	—	Crocoblock Jetengine^AI	22/1/2026	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.7.7.
CVE-2025-69333	Aplazada	Media (4.3)	0.19%	—	Crocoblock Jetengine^AI	7/1/2026	30/9/2026	Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.8.1.1.
CVE-2025-49938	Aplazada	Media (6.5)	0.22%	—	Crocoblock Jetengine^AI	22/10/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.3.
CVE-2025-53196	Aplazada	Media (6.5)	0.50%	—	Crocoblock Jetengine^AI	20/8/2025	17/6/2026	Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetEngine jet-engine allows Retrieve Embedded Sensitive Data.This issue affects JetEngine: from n/a through <= 3.7.0.
CVE-2025-53195	Aplazada	Media (6.5)	0.27%	—	Crocoblock Jetengine^AI	20/8/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.0.
CVE-2025-53194	Aplazada	Alta (8.5)	0.38%	—	Crocoblock Jetengine^AI	20/8/2025	17/6/2026	Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Code Injection.This issue affects JetEngine: from n/a through <= 3.7.0.
CVE-2025-54688	Aplazada	Media (6.5)	0.22%	—	Crocoblock Jetengine^AI	14/8/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.1.2.
CVE-2025-26870	Aplazada	Media (6.5)	0.27%	—	Crocoblock Jetengine^AI	15/4/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through <= 3.6.4.1.
CVE-2025-0369	Aplazada	Media (6.4)	0.33%	—	Crocoblock Jetengine^AI	18/1/2025	17/6/2026	The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘list_tag’ parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject…
CVE-2023-48758	Aplazada	Alta (7.1)	0.31%	—	Crocoblock Jetengine^AI	2/1/2025	17/6/2026	Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.2.4.
CVE-2023-48757	Aplazada	Alta (8.8)	0.55%	—	Crocoblock Jetengine^AI	17/5/2024	17/6/2026	Improper Privilege Management vulnerability in Crocoblock JetEngine allows Privilege Escalation.This issue affects JetEngine: from n/a through 3.2.4.
CVE-2023-1406	Modificada	Alta (8.8)	1.5%	—	Crocoblock Jetengine FOR Elementor	10/4/2023	17/6/2026	The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability.
CVE-2021-41844	Modificada	Crítica (9.8)	1.1%	—	Crocoblock Jetengine	15/12/2021	17/6/2026	Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data.
CVE-2021-38607	Modificada	Media (5.4)	0.60%	—	Crocoblock Jetengine	16/8/2021	17/6/2026	Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input.