Crítica
CVE-2026-54051
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 557
Restablecer filtros
Crítica
CVE-2026-48814
Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
Media
CVE-2026-55591
Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints
Alta
CVE-2026-53853
OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
Alta
CVE-2026-64657
budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL
Alta
CVE-2026-57495
AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)
Alta
CVE-2026-57133
npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
Crítica
CVE-2026-57139
npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call
Alta
CVE-2026-57136
npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
Crítica
CVE-2026-57138
npm PraisonAI codeMode sandbox escape via Function constructor
Alta
CVE-2026-57134
npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
Alta
CVE-2026-55603
http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
Media
CVE-2026-56775
n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints
Media
CVE-2026-49993
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
Baja
CVE-2026-56317
Cross-site scripting via <NoScript> slot content in Nuxt's head components
Alta
CVE-2026-54305
n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
Media
CVE-2026-54298
Astro: XSS via Unescaped Attribute Names in Spread Props
Alta
CVE-2026-50146
Astro: Reflected XSS via unescaped slot name
Alta
CVE-2026-11417
aws-cdk-lib: OS Command Injection in NodejsFunction Bundling
Baja
CVE-2026-53663
React Router: Potential CSRF via PUT/PATCH/DELETE document requests
Baja
CVE-2026-65900
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
Media
CVE-2026-82661
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
Media
CVE-2026-53655
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
Alta
CVE-2026-49982
tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.