Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2950▲ 8 respecto a la semana anterior

Críticas / altas1450▲ 184 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)272▼ 254 respecto a la semana anterior

8 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-105049	Recibida	Media (5.8)	0.22%	—	Zilliz Attu^AI	2/10/2026	5/10/2026	Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet.
CVE-2026-105048	Recibida	Media (4)	0.19%	—	Zilliz Attu^AI	2/10/2026	2/10/2026	The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses).
CVE-2025-30837	Aplazada	Alta (7.1)	0.31%	—	Cristiano Zanca Woocommerce Fattureincloud^AI	1/4/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristiano Zanca WooCommerce Fattureincloud woo-fattureincloud allows Reflected XSS.This issue affects WooCommerce Fattureincloud: from n/a through <= 2.6.7.
CVE-2023-5211	Modificada	Media (6.1)	0.40%	—	Fattura24	31/10/2023	17/6/2026	The Fattura24 WordPress plugin before 6.2.8 does not sanitize or escape the 'id' parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting vulnerability.
CVE-2014-6863	Modificada	Media (5.4)	0.27%	—	Digitalfruit Mootorratturid & Biker.ee	2/10/2014	17/6/2026	The Mootorratturid & biker.ee (aka ee.digitalfruit.mootorratturid) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2009-3122	Modificada	Media (6.4)	1.4%	—	Chris Shattuck Ajaxtable	9/9/2009	16/6/2026	The Ajax Table module 5.x for Drupal does not perform access control, which allows remote attackers to delete arbitrary users and nodes via unspecified vectors.
CVE-2009-3121	Modificada	Media (4.3)	1.2%	—	Chris Shattuck Ajaxtable	9/9/2009	16/6/2026	Cross-site scripting (XSS) vulnerability in the Ajax Table module 5.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2007-3067	Modificada	Media (4.3)	1.1%	—	Eqdkp Attunement AND KEY	6/6/2007	16/6/2026	Cross-site scripting (XSS) vulnerability in the Attunement and Key Tracker 0.95 and earlier plugin for EQdkp allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving the (1) keyshow, (2) sortkey, and (3) show parameters to index.php.