Baja
CVE-2026-6011
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 2.493
Restablecer filtros
Media
CVE-2026-39315
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()
Media
CVE-2026-42422
OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing
Media
CVE-2025-62718
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Media
CVE-2026-35041
fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification
Media
CVE-2026-35040
fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)
Baja
CVE-2026-5833
awwaiid mcp-server-taskwarrior vulnerable to command injection
Media
CVE-2026-5832
api-lab-mcp vulnerable to SSRF
Media
CVE-2026-5831
Agions taskflow-ai vulnerable to os command injection in src/mcp/server/handlers.ts
Alta
ghsa-5478-66c3-rhxr
Pretext: Algorithmic Complexity (DoS) in the text analysis phase
Alta
CVE-2026-39983
basic-ftp has FTP Command Injection via CRLF
Alta
CVE-2026-39974
n8n-mcp has authenticated SSRF via instance-URL header in multi-tenant HTTP mode
Alta
CVE-2026-39885
mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
Media
CVE-2026-39865
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
Media
CVE-2026-82853
Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)
Media
CVE-2026-39859
LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read
Media
CVE-2026-39411
LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header
Media
CVE-2026-39410
Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()
Media
CVE-2026-39407
Hono: Middleware bypass via repeated slashes in serveStatic
Media
CVE-2026-39406
@hono/node-server: Middleware bypass via repeated slashes in serveStatic
Media
CVE-2026-39381
Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`
Alta
CVE-2026-39371
RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests
Media
CVE-2026-39321
Parse Server has a login timing side-channel reveals user existence
Alta
CVE-2026-34148
Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.