Media
CVE-2026-41300
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 2.493
Restablecer filtros
Crítica
CVE-2026-34950
fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key
Crítica
ghsa-3hfp-gqgh-xc5g
Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions
Baja
CVE-2026-5323
a11y-mcp: Server-Side Request Forgery (SSRF) vulnerability in A11yServer function
Alta
ghsa-w2fm-25vw-vh7f
mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')
Alta
CVE-2026-34825
NocoBase Has SQL Injection via template variable substitution in workflow SQL node
Alta
CVE-2026-34784
Parser Server's streaming file download bypasses afterFind file trigger authorization
Alta
CVE-2026-34752
Haraka affected by DoS via `__proto__` email header
Alta
CVE-2026-34725
dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration
Media
ghsa-x3ff-w252-2g7j
StableLib Ed25519 Signature Malleability via Missing S < L Check
Media
CVE-2026-34526
SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6
Alta
CVE-2026-34524
SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root
Media
CVE-2026-34523
SillyTavern: Path Traversal allows file existence oracle
Alta
CVE-2026-34522
SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory
Media
CVE-2026-34749
Payload has a CSRF Protection Bypass in Authentication Flow
Alta
CVE-2026-34746
Payload has Authenticated SSRF via Upload Functionality
Alta
CVE-2026-34604
@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions
Alta
CVE-2026-34603
@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions
Media
CVE-2026-34595
Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value
Media
CVE-2026-34574
Parse Server has a session field immutability bypass via falsy-value guard
Media
CVE-2026-33578
OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgrade
Alta
CVE-2026-41371
OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset`
Media
CVE-2026-33577
OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes
Alta
CVE-2026-41299
OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.