p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de la pila PHP · Página 38

Vulnerabilidades publicadas para PHP en los últimos 30 días: 216. Incluidas en el catálogo KEV: 2.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
PHP

Alertas tempranas

Avisos recientes de vulnerabilidades procedentes de anuncios de fabricantes y noticias de seguridad. Estas alertas no cambian la puntuación de seguridad.

  1. php

    Sin corrección publicada

    PHP: ejecución remota de código

    Según OpenNet, PHP tiene una vulnerabilidad de ejecución remota de código (CVE-2026-115560). No se especifican las versiones exactas afectadas. El mensaje no indica una versión corregida.

    Qué hacer ahora: Comprueba si hay una actualización de PHP con la corrección e instálala.

    CVE-2026-115560

    opennet ↗the-hacker-news ↗

Vulnerabilidades: 7231

  1. CVE-2026-55806

    Media · CVSS 5.9EPSS 0,34%Corrección disponible

    Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

    drupal core drupal/corePHP
    • Actualiza a 10.5.12
    • Actualiza a 10.6.11
    • Actualiza a 11.1.0
    • Actualiza a 11.2.0
    • Actualiza a 11.2.14
    • Actualiza a 11.3.12
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  2. CVE-2026-55804

    Media · CVSS 5.9EPSS 0,35%Corrección disponible

    Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

    drupal core drupal/corePHP
    • Actualiza a 10.5.12
    • Actualiza a 10.6.11
    • Actualiza a 11.1.0
    • Actualiza a 11.2.0
    • Actualiza a 11.2.14
    • Actualiza a 11.3.12
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  3. CVE-2026-55803

    Media · CVSS 5.9EPSS 0,35%Corrección disponible

    Drupal core - Critical - PHP object injection - SA-CORE-2026-005

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

    drupal core drupal/corePHP
    • Actualiza a 10.5.12
    • Actualiza a 10.6.11
    • Actualiza a 11.1.0
    • Actualiza a 11.2.0
    • Actualiza a 11.2.14
    • Actualiza a 11.3.12
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  4. CVE-2026-15085

    Media · CVSS 5.4EPSS 0,23%Corrección disponible

    AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.

    ai seo/geo analyzer drupal/ai_seoPHP
    • Actualiza a 1.1.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  5. CVE-2026-15084

    Media · CVSS 5.4EPSS 0,23%Corrección disponible

    UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.

    ui patterns (sdc in drupal ui) drupal/ui_patternsPHP
    • Actualiza a 2.0.17
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  6. CVE-2026-15083

    Media · CVSS 4.2EPSS 0,23%Corrección disponible

    ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4.

    eca: event - condition - action drupal/ecaPHP
    • Actualiza a 2.1.20
    • Actualiza a 3.0.12
    • Actualiza a 3.1.4
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  7. CVE-2026-15082

    Media · CVSS 5.4EPSS 0,23%Corrección disponible

    Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (XSS). This issue affects Siteimprove Analytics versions: from 0.0.0 to 2.0.1.

    siteimprove analytics drupal/siteimprove_analyticsPHP
    • Actualiza a 2.0.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  8. CVE-2026-15081

    Alta · CVSS 7.4EPSS 0,34%Corrección disponible

    Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection. This issue affects Location Selector versions: from 0.0.0 to 1.3.0.

    location selector drupal/location_selectorPHP
    • Actualiza a 1.3.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  9. CVE-2026-15080

    Media · CVSS 4.3EPSS 0,14%Corrección disponible

    Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.4, from 11.0.0 to 11.0.4.

    ray enterprise translation drupal/lingotekPHP
    • Actualiza a 11.0.4
    • Actualiza a 4.0.4
    • Actualiza a 4.1.4
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  10. CVE-2026-15079

    Media · CVSS 5.4EPSS 0,28%Corrección disponible

    Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.

    login disable drupal/login_disablePHP
    • Actualiza a 2.1.4
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  11. CVE-2026-58591

    Media · CVSS 5.4EPSS 0,23%Corrección disponible

    Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.

    colorbox drupal/colorboxPHP
    • Actualiza a 2.1.5
    • Actualiza a 2.2.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  12. CVE-2026-58590

    Media · CVSS 5.4EPSS 0,23%Corrección disponible

    FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068

    Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.

    flowdrop drupal/flowdropPHP
    • Actualiza a 1.6.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  13. CVE-2026-58589

    Media · CVSS 5.4EPSS 0,23%Corrección disponible

    FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067

    Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.

    flowdrop drupal/flowdropPHP
    • Actualiza a 1.6.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  14. CVE-2026-58588

    Media · CVSS 6.1EPSS 0,26%Corrección disponible

    Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.

    drupal canvas drupal/canvasPHP
    • Actualiza a 1.4.2
    • Actualiza a 1.5.2
    • Actualiza a 1.6.1
    • Actualiza a 1.7.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  15. CVE-2026-58587

    Media · CVSS 6.1EPSS 0,26%Corrección disponible

    Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.

    drupal canvas drupal/canvasPHP
    • Actualiza a 1.4.2
    • Actualiza a 1.5.2
    • Actualiza a 1.6.1
    • Actualiza a 1.7.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  16. CVE-2026-13244

    Alta · CVSS 8.1EPSS 0,43%Corrección disponible

    Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0.

    tealium iq tag management drupal/tealiumiqPHP
    • Actualiza a 2.4.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  17. CVE-2026-13243

    Media · CVSS 4.8EPSS 0,12%Corrección disponible

    Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.

    salesforce suite drupal/salesforcePHP
    • Actualiza a 5.1.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  18. CVE-2026-13242

    Media · CVSS 6.5EPSS 0,28%Corrección disponible

    Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0.

    geolocation field drupal/geolocationPHP
    • Actualiza a 3.15.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  19. CVE-2026-13241

    Media · CVSS 6.5EPSS 0,27%Corrección disponible

    Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061

    Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

    paragraphs drupal/paragraphsPHP
    • Actualiza a 1.21.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  20. CVE-2026-13240

    Media · CVSS 6.5EPSS 0,27%Corrección disponible

    Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060

    Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

    paragraphs drupal/paragraphsPHP
    • Actualiza a 1.21.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →