Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2970▼ 106 respecto a la semana anterior

Críticas / altas1447▲ 86 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)350▼ 160 respecto a la semana anterior

1468 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-102911	Aplazada	Alta (8.6)	1.8%	—	Zosmaai Pi-llm-wiki^AI	30/9/2026	30/9/2026	A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be executed remotely. The exploit has been published and may…
CVE-2026-103051	Pendiente de análisis	Media (6.1)	0.15%	—	Wikimedia Centralnotice^AI	29/9/2026	30/9/2026	Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS. This issue affects Mediawiki - CentralNotice extension: before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-103050	Pendiente de análisis	Media (6.1)	0.15%	—	Wikimedia Massmessage^AI	29/9/2026	30/9/2026	Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-103049	Pendiente de análisis	Media (6.1)	0.15%	—	Wikimedia Cargo^AI	29/9/2026	30/9/2026	Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1.
CVE-2026-103048	Pendiente de análisis	Media (6.1)	0.15%	—	Wikimedia Collection^AI	29/9/2026	1/10/2026	URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data. This issue affects Mediawiki - Collection extension: before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-103047	Pendiente de análisis	Media (6.1)	0.15%	—	Wikimedia Centralauth^AI	29/9/2026	30/9/2026	Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-103046	Pendiente de análisis	Media (6.1)	0.15%	—	Wikimedia Wikilambda^AI	29/9/2026	30/9/2026	Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored XSS. This issue affects MediaWiki - WikiLambda extension: before 1.46.1.
CVE-2026-103045	Pendiente de análisis	Media (6.1)	0.15%	—	Wikimedia Mediawiki Refreshed Skin^AI	29/9/2026	30/9/2026	Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS. This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-103044	Pendiente de análisis	Crítica (9.8)	0.44%	—	Wikimedia Easytimeline^AI	29/9/2026	1/10/2026	XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-102796	Pendiente de análisis	Alta (7.5)	0.25%	—	Wikimedia Userpageviewtracker^AI	29/9/2026	1/10/2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection. This issue affects Mediawiki - UserPageViewTracker Extension: from * before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-100245	Pendiente de análisis	Media (6.1)	0.15%	—	Wikimedia Wikibase^AI	29/9/2026	30/9/2026	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Stored XSS. This issue affects Mediawiki - Wikibase Extension: from * before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-100244	Pendiente de análisis	Alta (7.5)	0.26%	—	Wikimedia Centralauth^AI	29/9/2026	30/9/2026	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from * before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-100243	Pendiente de análisis	Media (6.1)	0.15%	—	Wikimedia Wikiseo^AI	29/9/2026	30/9/2026	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension allows Stored XSS. This issue affects Mediawiki - WikiSEO Extension: from * before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-100242	Pendiente de análisis	Alta (7.5)	0.34%	—	Wikimedia Datatransfer^AI	29/9/2026	1/10/2026	Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation. This issue affects Mediawiki - DataTransfer Extension: from 1.46.0 before 1.47.0.
CVE-2026-100241	Pendiente de análisis	Alta (7.5)	0.31%	—	Wikimedia Eventbus^AI	29/9/2026	30/9/2026	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation. This issue affects Mediawiki - EventBus Extension: 1.47.0-alpha.
CVE-2026-100240	Pendiente de análisis	Crítica (9.1)	0.30%	—	Wikimedia Template Sandbox^AI	29/9/2026	1/10/2026	Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-100238	Pendiente de análisis	Media (6.1)	0.19%	—	Wikimedia Mediawiki Flow Extension^AI	29/9/2026	30/9/2026	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS. This issue affects Mediawiki - Flow Extension: from * before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-100383	Pendiente de análisis	Media (4.8)	0.32%	—	Wikimedia Wikilambda^AI	25/9/2026	28/9/2026	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.
CVE-2026-100382	Pendiente de análisis	Crítica (10)	0.95%	💥 PoC	Wikimedia External Data^AI	25/9/2026	28/9/2026	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * before 3.7.
CVE-2026-100381	Pendiente de análisis	Media (5.3)	0.33%	💥 PoC	Wikimedia Uploadwizard^AI	25/9/2026	28/9/2026	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - UploadWizard Extension: from * before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-96879	Pendiente de análisis	Media (6.9)	0.26%	—	Wikimedia Flaggedrevs^AI	25/9/2026	29/9/2026	Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.
CVE-2026-100380	Pendiente de análisis	Media (5.3)	0.33%	💥 PoC	Wikimedia Wikibase^AI	25/9/2026	28/9/2026	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Wikibase Extension: from * before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-100379	Pendiente de análisis	Media (5.3)	0.32%	—	Wikimedia Wikipedia Android APP^AI	25/9/2026	28/9/2026	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main.
CVE-2026-100378	Pendiente de análisis	Media (5.3)	0.27%	—	Wikimedia Translate^AI	25/9/2026	28/9/2026	Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - Translate Extension: from * before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-100377	Pendiente de análisis	Media (6.9)	0.32%	—	Wikimedia Wikilambda^AI	25/9/2026	28/9/2026	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.