Media
CVE-2026-41885
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 540
Restablecer filtros
Alta
CVE-2026-41683
i18next-http-middleware: HTTP response splitting and DoS via unsanitised Content-Language header
Alta
CVE-2026-41673
xmldom: Uncontrolled recursion in XML serialization leads to DoS
Alta
CVE-2026-41641
@nocobase/plugin-collection-sql: SQL Validation Bypass Through Missing `checkSQL` Call
Alta
CVE-2026-41693
i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite
Media
CVE-2026-41692
i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes
Media
CVE-2026-41691
i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns
Alta
CVE-2026-41690
i18next-http-middleware: Prototype pollution and path traversal via user-controlled language and namespace parameters
Media
CVE-2026-41067
Astro: XSS in define:vars via incomplete </script> tag sanitization
Media
CVE-2026-40155
Auth0 Next.js SDK has Improper Proxy Cache Lookup
Alta
CVE-2026-40931
Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing
Crítica
ghsa-vr7g-88fq-vhq3
Paperclip: OS Command Injection via Execution Workspace cleanupCommand
Alta
ghsa-xfqj-r5qw-8g4j
Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode
Crítica
CVE-2026-41428
Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints
Alta
CVE-2026-41423
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
Alta
CVE-2026-41138
Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.
Crítica
CVE-2026-41248
Official Clerk JavaScript SDKs: Middleware-based route protection bypass
Alta
CVE-2026-41180
PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart
Crítica
CVE-2026-33808
@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Crítica
CVE-2026-33807
@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes
Alta
ghsa-26wg-9xf2-q495
Novu has a XSS sanitization bypass
Alta
ghsa-4x48-cgf9-q33f
Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
Baja
ghsa-x7mm-9vvv-64w8
unhead: Streaming SSR `streamKey` injected into inline script without identifier validation
Crítica
CVE-2026-41679
paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.