Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2987▼ 96 respecto a la semana anterior

Críticas / altas1458▲ 101 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)350▼ 160 respecto a la semana anterior

5 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-83628	Aplazada	Media (4.3)	0.39%	—	Thememylogin Theme MY Login^AI	5/9/2026	8/9/2026	The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the `tml_ms_signup_handler()` function's `gimmeanotherblog` branch failing to enforce the network's `active_signup` registration policy, checking only…
CVE-2026-66681	Aplazada	Media (4.3)	0.14%	—	Thememylogin Theme MY Login^AI	6/8/2026	12/8/2026	Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.
CVE-2024-7422	Aplazada	Media (4.3)	0.20%	—	Thememylogin Theme MY Login^AI	16/8/2024	17/6/2026	The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tml_admin_save_ms_settings() function. This makes it possible for unauthenticated attackers to update the theme's settings via a…
CVE-2024-32525	Aplazada	Media (4.3)	0.34%	—	Thememylogin Theme MY Login^AI	17/4/2024	17/6/2026	Missing Authorization vulnerability in Theme My Login.This issue affects Theme My Login: from n/a through 7.1.6.
CVE-2023-6272	Modificada	Crítica (9.8)	0.89%	—	Thememylogin 2FA	18/12/2023	17/6/2026	The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits.