Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2704▼ 598 respecto a la semana anterior
Críticas / altas1288▼ 199 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)299▼ 211 respecto a la semana anterior
36 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Aplazada | Alta (7.5) | 0.39% | — | Themeum KirkiAI | 13/7/2026 | 13/7/2026 | Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through <= 6.0.13. | |
| Aplazada | Crítica (9.3) | 0.40% | — | Themeum KirkiAI | 13/7/2026 | 13/7/2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through <= 6.0.12. | |
| Aplazada | Alta (7.1) | 0.25% | — | Themeum KirkiAI | 13/7/2026 | 13/7/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects Kirki: from n/a through <= 6.0.11. | |
| Aplazada | Crítica (9.8) | 0.56% | — | Themeum KirkiAI | 13/7/2026 | 13/7/2026 | Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12. | |
| Aplazada | Media (6.5) | 0.33% | — | KirkiAI | 2/7/2026 | 2/7/2026 | Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions. | |
| Aplazada | Media (5.3) | 0.60% | — | KirkiAI | 2/7/2026 | 2/7/2026 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers… | |
| Aplazada | Media (5.3) | 0.50% | — | KirkiAI | 2/7/2026 | 2/7/2026 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible for unauthenticated attackers to extract the full builder metadata and rendered HTML of any… | |
| Aplazada | Media (4.9) | 0.19% | — | Aristeides Stathopoulos KirkiAI | 26/6/2026 | 26/6/2026 | Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions. | |
| Aplazada | Crítica (9.8) | 0.77% | 💥 PoC | KirkiAI | 2/6/2026 | 22/7/2026 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible… | |
| Aplazada | Media (6.5) | 0.46% | — | KirkiAI | 19/5/2026 | 24/7/2026 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,… | |
| Aplazada | Alta (7.5) | 0.54% | — | KirkiAI | 19/5/2026 | 24/7/2026 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to, and including, 6.0.6. This makes it possible for unauthenticated… |