Media
CVE-2026-39365
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 2.493
Restablecer filtros
Alta
CVE-2026-39364
Vite: `server.fs.deny` bypassed with queries
Alta
CVE-2026-39363
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
Media
CVE-2026-35515
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
Alta
CVE-2026-35209
defu: Prototype pollution via `__proto__` key in defaults argument
Alta
ghsa-6q22-g298-grjh
Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver
Media
CVE-2026-35441
Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits
Alta
CVE-2026-35409
Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
Media
CVE-2026-35413
Directus: GraphQL Schema SDL Disclosure Setting
Media
CVE-2026-35410
Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow
Alta
CVE-2026-39942
Directus: Path Traversal and Broken Access Control in File Management API
Alta
CVE-2026-35408
Directus: Missing Cross-Origin Opener Policy
Crítica
CVE-2026-35216
Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
Alta
CVE-2026-35214
Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write
Alta
CVE-2026-35394
@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url
Baja
CVE-2026-35200
Parse Server: File upload Content-Type override via extension mismatch
Alta
CVE-2026-25044
Budibase: Command Injection in Bash Automation Step
Media
CVE-2026-34211
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
Media
CVE-2026-34083
Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow
Media
CVE-2026-33951
Signal K Server: Unauthenticated Source Priorities Manipulation
Crítica
CVE-2026-33950
Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity
Crítica
CVE-2026-31818
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
Crítica
CVE-2026-35039
fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)
Baja
CVE-2026-35038
Signal K Server: Arbitrary Prototype Read via `from` Field Bypass
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.