Media
CVE-2026-4923
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 759
Restablecer filtros
Alta
CVE-2026-33979
Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)
Alta
CVE-2026-33943
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
Alta
CVE-2026-33895
Forge has signature forgery in Ed25519 due to missing S > L check
Alta
CVE-2026-33894
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
Media
CVE-2026-33732
srvx is vulnerable to middleware bypass via absolute URI in request line
Alta
CVE-2026-33671
Picomatch has a ReDoS vulnerability via extglob quantifiers
Crítica
CVE-2026-26831
textract is vulnerable to OS Command Injection
Alta
CVE-2026-33627
Parse Server exposes auth data via /users/me endpoint
Alta
ghsa-g3qj-j598-cxmq
fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing
Media
CVE-2026-86205
H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation
Alta
CVE-2026-4601
jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction
Alta
CVE-2026-32887
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
Crítica
ghsa-wvr4-3wq4-gpc5
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint
Alta
CVE-2026-33226
Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview
Crítica
CVE-2026-32731
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
Alta
CVE-2026-33142
OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters
Media
CVE-2026-86253
h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read
Alta
CVE-2026-32256
music-metadata has an infinite loop vulnerability in ASF parser
Alta
CVE-2026-33036
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
Crítica
CVE-2026-31938
jsPDF has HTML Injection in New Window paths
Media
CVE-2026-32598
OneUptime: Password Reset Token Logged at INFO Level
Crítica
CVE-2026-32306
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
Baja
CVE-2026-32970
OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.