Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2568▼ 331 respecto a la semana anterior

Críticas / altas1352▲ 94 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 7 respecto a la semana anterior

Sin puntuar (sin CVSS)56▼ 472 respecto a la semana anterior

4 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2025-54745	Aplazada	Media (6.5)	0.31%	—	Miniorange 2 Factor Authentication^AI	18/12/2025	30/9/2026	Missing Authorization vulnerability in miniOrange miniOrange's Google Authenticator miniorange-2-factor-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniOrange's Google Authenticator: from n/a through <= 6.1.1.
CVE-2022-28601	Modificada	Media (6.5)	1.7%	—	Lmsdoctor 2 Factor Authentication	10/5/2022	17/6/2026	A Two-Factor Authentication (2FA) bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor allows remote attackers to overwrite the phone number used for confirmation via the profile.php file. Therefore, allowing them to bypass the phone verification mechanism.
CVE-2022-28986	Modificada	Alta (7.5)	2.3%	—	Lmsdoctor 2 Factor Authentication	10/5/2022	9/7/2026	LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts.
CVE-2020-24655	Modificada	Media (5.1)	0.22%	—	Twilio Authy 2-factor Authentication	10/9/2020	17/6/2026	A race condition in the Twilio Authy 2-Factor Authentication application before 24.3.7 for Android allows a user to potentially approve/deny an access request prior to unlocking the application with a PIN on older Android devices (effectively bypassing the PIN requirement).