Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2757▲ 47 respecto a la semana anterior
Críticas / altas1482▲ 372 respecto a la semana anterior
Nueva explotación activa (KEV)7▼ 3 respecto a la semana anterior
Sin puntuar (sin CVSS)64▼ 462 respecto a la semana anterior
4 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Pendiente de análisis | Media (6.4) | 0.40% | — | VenuelessAI | 31/8/2026 | 3/9/2026 | The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set. | |
| Aplazada | Media (5.1) | 0.35% | — | VenuelessAI | 22/6/2026 | 23/6/2026 | An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains. | |
| Pendiente de análisis | Alta (7.3) | 0.38% | — | VenuelessAI | 5/4/2026 | 20/7/2026 | A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds. | |
| Pendiente de análisis | Alta (7.3) | 0.38% | — | VenuelessAI | 27/3/2026 | 17/6/2026 | A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature. The exploitability is limited by the fact that the attacker needs to know the internal channel UUID of the chat… |