Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2570▼ 302 respecto a la semana anterior
Críticas / altas1352▲ 100 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 7 respecto a la semana anterior
Sin puntuar (sin CVSS)56▼ 472 respecto a la semana anterior
7 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Aplazada | Alta (7.5) | 0.43% | — | Shopify ContributorAI | 2/7/2026 | 2/7/2026 | Contributor Local File Inclusion in Shopify <= 1.0.0 versions. | |
| Aplazada | Alta (8.5) | 0.36% | — | Contributor SQL Injection IN Custom Field TemplateAI | 2/7/2026 | 2/7/2026 | Contributor SQL Injection in Custom Field Template <= 2.7.8 versions. | |
| Aplazada | Media (6.1) | 0.78% | — | List Site ContributorsAI | 14/1/2026 | 17/6/2026 | The List Site Contributors plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'alpha' parameter in versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages… | |
| Aplazada | Media (6.1) | 0.13% | — | YcontributorsAI | 4/7/2025 | 17/6/2026 | The yContributors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on the 'yContributors' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a… | |
| Aplazada | Alta (7.1) | 0.29% | — | Maheshwaghmare MG Post ContributorsAI | 9/11/2024 | 17/6/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Waghmare MG Post Contributors mg-post-contributors allows Reflected XSS.This issue affects MG Post Contributors: from n/a through <= 1.3.. | |
| Modificada | Alta (8.1) | 0.47% | — | SAP Contributor License Agreement Assistant | 15/8/2023 | 17/6/2026 | A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as well as custom fields… | |
| Modificada | Media (6.5) | 0.83% | — | SAP Contributor License Agreement Assistant | 6/6/2022 | 17/6/2026 | Due to improper error handling an authenticated user can crash CLA assistant instance. This could impact the availability of the application. |