Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2567▼ 298 respecto a la semana anterior
Críticas / altas1351▲ 99 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 7 respecto a la semana anterior
Sin puntuar (sin CVSS)62▼ 466 respecto a la semana anterior
5 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Aplazada | Alta (8.5) | 0.17% | — | KongaAIOpensslAI | 1/9/2026 | 8/9/2026 | Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path absent from default installations. On Windows, the missing directory resides in a… | |
| Analizada | Media (5.4) | 0.45% | — | Pantsel Konga | 14/5/2024 | 17/6/2026 | Konga v0.14.9 is vulnerable to Cross Site Scripting (XSS) via the username parameter. | |
| Modificada | Crítica (9.8) | 1.1% | — | Pantsel Konga | 16/8/2023 | 17/6/2026 | An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token. | |
| Modificada | Media (6.5) | 1.1% | — | Konga Project Konga | 1/5/2023 | 17/6/2026 | An issue discovered in Konga 0.14.9 allows remote attackers to manipulate user accounts regardless of privilege via crafted POST request. | |
| Modificada | Alta (8.8) | 10% | — | Konga Project Konga | 4/5/2022 | 17/6/2026 | Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation. |