Media
CVE-2026-57295
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 3.280
Restablecer filtros
Media
CVE-2026-57285
Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs
Media
CVE-2026-57286
Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names
Media
CVE-2026-48480
OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation
Media
CVE-2026-54517
jackson-databind has @JsonView bypass for setterless creator properties
Media
CVE-2026-54516
jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields
Media
CVE-2026-54515
jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
Media
CVE-2026-54514
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
Alta
CVE-2026-54513
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
Alta
CVE-2026-54512
jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation
Media
CVE-2026-54518
jackson-databind has a @JsonView bypass for unwrapped creator parameters
Alta
CVE-2026-45049
OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet
Alta
CVE-2026-45048
OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC
Baja
CVE-2026-44793
OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`
Crítica
CVE-2026-44203
OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)
Media
CVE-2026-44202
OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`
Crítica
CVE-2026-44179
xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro
Media
CVE-2026-54665
Apache NiFi fails to validate proxy host headers when constructing qualified URLs
Crítica
CVE-2026-56120
OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
Media
CVE-2026-100834
http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments
Media
CVE-2026-100725
http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default
Alta
ghsa-m4w9-hjfw-vwj4
http4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`
Media
CVE-2026-100724
http4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`
Media
CVE-2026-55847
Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.