Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2584▼ 301 respecto a la semana anterior
Críticas / altas1355▲ 100 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 7 respecto a la semana anterior
Sin puntuar (sin CVSS)56▼ 472 respecto a la semana anterior
60 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Pendiente de análisis | Crítica (9.5) | 0.32% | — | Veeam Service Provider ConsoleAI | 4/8/2026 | 3/9/2026 | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials. | |
| Pendiente de análisis | Crítica (9) | 0.53% | — | Veeam Service Provider ConsoleAI | 4/8/2026 | 3/9/2026 | A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution. | |
| Pendiente de análisis | Alta (8.2) | 0.42% | — | Veeam Service Provider ConsoleAI | 4/8/2026 | 3/9/2026 | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins. | |
| Pendiente de análisis | Alta (8.7) | 0.45% | — | Veeam Service Provider ConsoleAI | 4/8/2026 | 3/9/2026 | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service. | |
| Pendiente de análisis | Media (5.3) | 0.29% | — | Veeam Service Provider ConsoleAI | 30/7/2026 | 3/9/2026 | Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to an… | |
| Analizada | Alta (7.4) | 0.34% | — | Miniorange Saml SSO - Service Provider | 28/5/2026 | 21/7/2026 | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation. This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.4. | |
| Aplazada | Crítica (9.4) | 0.60% | — | Veeam Service Provider ConsoleAI | 28/5/2026 | 17/6/2026 | This vulnerability in Veeam Service Provider Console allows for remote code execution. | |
| Analizada | Media (6.1) | 0.25% | — | Miniorange Saml SSO - Service Provider | 25/3/2026 | 17/6/2026 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS).This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.3. | |
| Aplazada | Crítica (9.1) | 0.40% | — | Shibboleth Service ProviderAI | 10/9/2025 | 25/9/2026 | An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of… | |
| Analizada | Media (6.5) | 0.25% | — | Veeam Service Provider Console | 4/12/2024 | 17/6/2026 | A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources. | |
| Modificada | Media (5.1) | 0.45% | — | Oretnom23 Service Provider Management System | 23/6/2024 | 17/6/2026 | A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown functionality of the file system_info/index.php of the component System Info Page. The manipulation of the argument System Name/System Short Name leads to cross… | |
| Analizada | Crítica (9.9) | 1.6% | — | Veeam Service Provider Console | 14/5/2024 | 17/6/2026 | Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its components, under certain conditions, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine. | |
| Modificada | Crítica (9.8) | 1.4% | — | Oretnom23 Service Provider Management System | 25/9/2023 | 17/6/2026 | An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoint. | |
| Modificada | Media (5.4) | 0.79% | — | Oretnom23 Service Provider Management System | 25/9/2023 | 17/6/2026 | Cross Site Scripting vulnerability in Service Provider Management System v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the firstname, middlename and lastname parameters in the /php-spms/admin/?page=user endpoint. | |
| Modificada | Crítica (9.8) | 0.49% | — | Oretnom23 Service Provider Management System | 12/7/2023 | 17/6/2026 | A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /classes/Master.php?f=save_inquiry. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. VDB-233890 is… | |
| Modificada | Crítica (9.8) | 3.3% | — | Oretnom23 Service Provider Management System | 12/6/2023 | 17/6/2026 | Sourcecodester Service Provider Management System v1.0 is vulnerable to SQL Injection via the ID parameter in /php-spms/?page=services/view&id=2 | |
| Modificada | Alta (7.2) | 0.69% | — | Oretnom23 Service Provider Management System | 6/6/2023 | 17/6/2026 | A vulnerability, which was classified as critical, was found in SourceCodester Service Provider Management System 1.0. This affects an unknown part of the file view_service.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to… | |
| Modificada | Alta (8.8) | 0.73% | — | Oretnom23 Service Provider Management System | 6/6/2023 | 17/6/2026 | A vulnerability, which was classified as critical, has been found in SourceCodester Service Provider Management System 1.0. Affected by this issue is some unknown functionality of the file view.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been… | |
| Modificada | Alta (8.8) | 0.73% | — | Oretnom23 Service Provider Management System | 17/5/2023 | 17/6/2026 | A vulnerability classified as critical has been found in SourceCodester Service Provider Management System 1.0. This affects an unknown part of the file /classes/Master.php?f=delete_service. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been… | |
| Modificada | Media (5.4) | 0.56% | — | Oretnom23 Service Provider Management System | 27/4/2023 | 17/6/2026 | A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit… | |
| Modificada | Media (5.4) | 0.56% | — | Oretnom23 Service Provider Management System | 27/4/2023 | 17/6/2026 | A vulnerability classified as problematic has been found in SourceCodester Service Provider Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument page leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been… | |
| Modificada | Crítica (9.8) | 0.82% | — | Oretnom23 Service Provider Management System | 27/4/2023 | 17/6/2026 | A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been… | |
| Modificada | Crítica (9.8) | 0.82% | — | Oretnom23 Service Provider Management System | 27/4/2023 | 17/6/2026 | A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/services/manage_service.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has… | |
| Modificada | Crítica (9.8) | 0.82% | — | Oretnom23 Service Provider Management System | 27/4/2023 | 17/6/2026 | A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/inquiries/view_inquiry.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has… | |
| Modificada | Crítica (9.8) | 0.51% | — | Oretnom23 Service Provider Management System | 27/4/2023 | 17/6/2026 | A vulnerability was found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_inquiry. The manipulation leads to improper authorization. The attack may be launched remotely. The identifier of… |