Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2698▼ 345 respecto a la semana anterior

Críticas / altas1316▼ 9 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)244▼ 273 respecto a la semana anterior

5 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-92569	Aplazada	Media (5.3)	0.34%	—	Opengoofy Hippo4j^AI	16/9/2026	24/9/2026	Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud metadata services.
CVE-2025-51606	Aplazada	Alta (8.8)	0.35%	—	Opengoofy Hippo4j^AI	21/8/2025	17/6/2026	hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical security risk in…
CVE-2023-27096	Modificada	Media (6.5)	0.60%	—	Opengoofy Hippo4j	27/3/2023	17/6/2026	Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker to obtain sensitive information via the ConfigVerifyController function of the Tenant Management module.
CVE-2023-27094	Modificada	Alta (8.8)	0.64%	—	Opengoofy Hippo4j	23/3/2023	17/6/2026	An issue found in OpenGoofy Hippo4j v.1.4.3 allows attackers to escalate privileges via the ThreadPoolController of the tenant Management module.
CVE-2023-27095	Modificada	Media (6.5)	0.56%	—	Opengoofy Hippo4j	16/3/2023	17/6/2026	Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UserController function in Tenant Management module.