Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2540▼ 352 respecto a la semana anterior

Críticas / altas1339▲ 68 respecto a la semana anterior

Nueva explotación activa (KEV)6▼ 6 respecto a la semana anterior

Sin puntuar (sin CVSS)62▼ 466 respecto a la semana anterior

9 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-58591	Analizada	Media (5.4)	0.23%	—	Colorbox Project Colorbox	10/7/2026	14/7/2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.
CVE-2026-8493	Analizada	Media (5.4)	0.23%	—	Colorbox Inline Project Colorbox Inline	19/5/2026	23/7/2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS). This issue affects Colorbox Inline: from 0.0.0 before 2.1.1.
CVE-2025-60124	Aplazada	Media (6.5)	0.21%	—	Ryan Hellyer Simple Colorbox^AI	26/9/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Hellyer Simple Colorbox simple-colorbox allows Stored XSS.This issue affects Simple Colorbox: from n/a through <= 1.6.1.
CVE-2025-3650	Aplazada	Baja (3.5)	0.18%	—	Jquery Colorbox^AI	12/9/2025	17/6/2026	The jQuery Colorbox WordPress plugin through 4.6.3 uses the colorbox library, which does not sanitize title attributes on links before using them, allowing users with at least the contributor role to conduct XSS attacks against administrators.
CVE-2025-49397	Aplazada	Media (6.5)	0.21%	—	Noor Alam Colorbox Lightbox^AI	20/8/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Colorbox Lightbox wp-colorbox allows Stored XSS.This issue affects Colorbox Lightbox: from n/a through <= 1.1.5.
CVE-2025-3900	Analizada	Media (6.1)	0.25%	—	Colorbox Project Colorbox	23/4/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS).This issue affects Colorbox: from 0.0.0 before 2.1.3.
CVE-2016-10865	Modificada	Media (6.1)	0.52%	—	23systems Lightbox Plus Colorbox	9/8/2019	17/6/2026	The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
CVE-2015-7881	Modificada	Baja (3.5)	0.87%	—	Colorbox Project Colorbox	26/10/2015	17/6/2026	The Colorbox module 7.x-2.x before 7.x-2.10 for Drupal allows remote authenticated users with certain permissions to bypass intended access restrictions and "add unexpected content to a Colorbox" via unspecified vectors, possibly related to a link in a comment.
CVE-2012-4474	Modificada	Media (4.3)	1.2%	—	Colorbox Node Dennis Blake	30/11/2012	16/6/2026	Multiple cross-site scripting (XSS) vulnerabilities in the Colorbox Node module 7.x-2.x before 7.x-2.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.