Crítica
CVE-2026-46703
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 2.476
Restablecer filtros
Crítica
CVE-2026-46695
BoxLite: Permission Bypass Allows Modification of Read-Only Files
Baja
CVE-2026-46553
NocoDB: Attachment Size Limit Bypass via Upload-by-URL
Media
CVE-2026-46551
NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion
Alta
CVE-2026-46519
MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement
Alta
CVE-2026-46492
md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)
Media
CVE-2026-56268
Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows
Media
CVE-2026-56277
Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage
Alta
CVE-2026-46417
@angular/platform-server: SSRF via Hostname Hijacking
Alta
ghsa-7hgr-7h44-33w2
CamoFox MCP: Unauthenticated HTTP MCP browser-control surface
Alta
CVE-2026-46372
SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl
Alta
CVE-2026-45783
@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
Baja
CVE-2026-46342
Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
Alta
CVE-2026-45805
PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
Media
CVE-2026-46357
HAX CMS: Denial of Service using Malicious Import Request
Media
CVE-2026-45773
Turbo: Login callback CSRF/session fixation
Crítica
CVE-2026-46339
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
Media
CVE-2026-46341
Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching
Alta
CVE-2026-46426
Budibase: Unrestricted Upload of File with Dangerous Type
Media
CVE-2026-46424
Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour
Media
CVE-2026-56348
n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass
Media
CVE-2026-56352
n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions
Media
CVE-2026-45670
Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)
Media
CVE-2026-45669
Nuxt: Reflected XSS in `navigateTo()` external redirect
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.