Alta
CVE-2026-46417
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 557
Restablecer filtros
Alta
CVE-2026-46426
Budibase: Unrestricted Upload of File with Dangerous Type
Media
CVE-2026-46424
Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour
Media
CVE-2026-45669
Nuxt: Reflected XSS in `navigateTo()` external redirect
Media
CVE-2026-45719
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
Alta
CVE-2026-45716
Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration
Alta
CVE-2026-45707
n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete
Alta
CVE-2026-22810
@joplin/onenote-converter: Path traversal in OneNote importer allows overwriting arbitrary files
Media
CVE-2026-45366
@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol
Alta
CVE-2026-46440
FlowiseAI Exposes Basic Auth Credentials via API
Alta
CVE-2026-45136
claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh
Alta
CVE-2026-44724
Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
Crítica
CVE-2026-45091
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
Alta
CVE-2026-42290
protobuf.js is Vulnerable to OS Command Injection in the CLI
Alta
CVE-2026-44635
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`
Crítica
CVE-2026-25244
WebdriverIO BrowserStack Service has a Command Injection issue
Alta
ghsa-mhwj-73qx-jqxm
@theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function
Media
CVE-2026-44576
Next.js vulnerable to cache poisoning in React Server Component responses
Media
CVE-2026-44458
Hono has CSS Declaration Injection via Style Object Values in JSX SSR
Crítica
ghsa-v6wj-c83f-v46x
@profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module
Media
CVE-2026-44214
eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fields
Media
ghsa-qhh4-458h-xwh2
@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry
Media
CVE-2026-8026
Flowise: Bcrypt Password Hash Exposure
Alta
CVE-2026-43893
exiftool-vendored vulnerable to argument injection via newline characters in tag names
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.