Crítica
CVE-2026-54617
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 278
Restablecer filtros
Alta
CVE-2026-53712
OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms
Alta
CVE-2026-39379
GeoNetwork has reflected XSS through client-side template injection
Media
CVE-2026-57285
Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs
Media
CVE-2026-44202
OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`
Crítica
CVE-2026-44179
xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro
Media
CVE-2026-100834
http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments
Media
CVE-2026-100725
http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default
Media
CVE-2026-100724
http4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`
Alta
CVE-2026-55772
CedarJava has type confusion vulnerability
Crítica
CVE-2026-55471
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
Media
CVE-2026-54697
ConnectBot SSH Client Library: Excessive allocation and integer overflow in DER private-key parsing
Alta
ghsa-j9gf-vw2f-9hrw
Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation
Media
CVE-2026-53698
Silverpeas mishandles the "Personal space" feature that is selected when no componentId is set
Media
CVE-2026-47838
Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates
Alta
CVE-2026-44894
Netty's Default QUIC token handler accepts any client-supplied token
Crítica
CVE-2026-46621
Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection
Crítica
CVE-2026-44632
Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`
Alta
CVE-2026-46481
OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users
Alta
CVE-2026-35194
Apache Flink: Remote code execution via SQL injection in code generation
Media
CVE-2026-45292
OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation
Crítica
CVE-2026-45091
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
Alta
CVE-2026-41713
Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
Alta
CVE-2026-39816
Apache NiFi is missing the Restricted annotation with the Execute Code Required Permission
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.