Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2703▼ 615 respecto a la semana anterior

Críticas / altas1293▼ 208 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)291▼ 219 respecto a la semana anterior

5 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2024-48445	Aplazada	Crítica (9.8)	2.0%	💥 Exploit	Compop Online Mall^AI	4/2/2025	17/6/2026	An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters.
CVE-2023-46448	Modificada	Media (6.1)	0.40%	—	Dmpop Mejiro	1/11/2023	17/6/2026	Reflected Cross-Site Scripting (XSS) vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code via crafted string in metadata of uploaded images.
CVE-2023-5538	Modificada	Media (6.1)	0.98%	💥 PoC	Mrpeng Mpoperationlogs	18/10/2023	17/6/2026	The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will…
CVE-2019-8337	Modificada	Media (5.3)	0.92%	—	Marlam Mpop Marlam Msmtp	13/2/2019	17/6/2026	In msmtp 1.8.2 and mpop 1.4.3, when tls_trust_file has its default configuration, certificate-verification results are not properly checked.
CVE-2009-3941	Modificada	Media (5)	0.93%	—	Martin Lambers Mpop	16/11/2009	16/6/2026	Martin Lambers mpop before 1.0.19, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the (1) subject's Common Name or (2) Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by…