p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de la pila PHP · Página 3

Vulnerabilidades publicadas para PHP en los últimos 30 días: 194. Incluidas en el catálogo KEV: 0.

RSS ↗
Filtrar vulnerabilidades
PHP

Vulnerabilidades: 7182

  1. CVE-2026-96362

    Media · CVSS 4.2EPSS 0,16%Corrección disponible

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Actualiza a 6.2.12
    • Actualiza a 6.3.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  2. CVE-2026-96363

    Sin evaluarEPSS 0,19%Corrección disponible

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Actualiza a 6.2.12
    • Actualiza a 6.3.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  3. CVE-2026-96367

    Media · CVSS 4.6EPSS 0,22%Corrección disponible

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Actualiza a 6.2.12
    • Actualiza a 6.3.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  4. CVE-2026-96368

    Media · CVSS 4.6EPSS 0,23%Corrección disponible

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Actualiza a 6.2.12
    • Actualiza a 6.3.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  5. CVE-2026-96370

    Media · CVSS 5.4EPSS 0,25%Corrección disponible

    Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164

    Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Actualiza a 6.2.12
    • Actualiza a 6.3.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  6. CVE-2026-96369

    Baja · CVSS 3.1EPSS 0,24%Corrección disponible

    Webform - Less critical - Access bypass - SA-CONTRIB-2026-165

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Actualiza a 6.2.12
    • Actualiza a 6.3.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  7. CVE-2026-96371

    Media · CVSS 5.4EPSS 0,18%Corrección disponible

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Actualiza a 6.2.12
    • Actualiza a 6.3.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  8. CVE-2026-96372

    Media · CVSS 5.4EPSS 0,25%Corrección disponible

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167

    Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Actualiza a 6.2.12
    • Actualiza a 6.3.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  9. CVE-2026-96373

    Baja · CVSS 3.3EPSS 0,18%Corrección disponible

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Actualiza a 6.2.12
    • Actualiza a 6.3.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  10. CVE-2026-96366

    Media · CVSS 5.3EPSS 0,34%Corrección disponible

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Actualiza a 6.2.12
    • Actualiza a 6.3.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  11. CVE-2026-96365

    Alta · CVSS 7.5EPSS 0,46%Corrección disponible

    Webform - Less critical - Denial of service - SA-CONTRIB-2026-170

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Actualiza a 6.2.12
    • Actualiza a 6.3.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  12. CVE-2026-96364

    Media · CVSS 5.3EPSS 0,23%Corrección disponible

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171

    Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Actualiza a 6.2.12
    • Actualiza a 6.3.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  13. CVE-2026-96357

    Media · CVSS 4.6EPSS 0,17%Corrección disponible

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Actualiza a 6.2.12
    • Actualiza a 6.3.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  14. CVE-2026-96398

    Media · CVSS 4.3EPSS 0,23%Corrección disponible

    Webform - Less critical - Access bypass - SA-CONTRIB-2026-173

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Actualiza a 6.2.12
    • Actualiza a 6.3.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  15. CVE-2026-96356

    Media · CVSS 5.3EPSS 0,34%Corrección disponible

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Actualiza a 6.2.12
    • Actualiza a 6.3.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  16. CVE-2026-96355

    Crítica · CVSS 9.1EPSS 0,43%Corrección disponible

    Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    webform drupal/webformPHP
    • Actualiza a 6.2.12
    • Actualiza a 6.3.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  17. CVE-2026-96375

    Media · CVSS 4.8EPSS 0,09%Corrección disponible

    Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176

    Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.

    cloud drupal/cloudPHP
    • Actualiza a 7.0.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  18. CVE-2026-96376

    Media · CVSS 6.4EPSS 0,57%Corrección disponible

    Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177

    Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.

    cloud drupal/cloudPHP
    • Actualiza a 7.0.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  19. CVE-2026-96374

    Media · CVSS 4.2EPSS 0,08%Corrección disponible

    Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5.

    project browser drupal/project_browserPHP
    • Actualiza a 2.0.3
    • Actualiza a 2.1.5
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  20. CVE-2026-96378

    Media · CVSS 4.3EPSS 0,3%Corrección disponible

    Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0.

    commerce decoupled checkout drupal/commerce_decoupled_checkoutPHP
    • Actualiza a 1.8.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →