Media
CVE-2026-33129
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 2.493
Restablecer filtros
Alta
CVE-2026-33128
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
Alta
CVE-2026-56236
Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)
Media
CVE-2026-33060
SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks
Media
CVE-2026-33042
Parse Server affected by empty authData bypassing credential requirement on signup
Media
CVE-2026-32770
Parse Server LiveQuery subscription with invalid regular expression crashes server
Media
CVE-2026-32742
Parse Server session creation endpoint allows overwriting server-generated session fields
Media
CVE-2026-32878
Parse Server vulnerable to schema poisoning via prototype pollution in deep copy
Alta
CVE-2026-32886
Parse Server's Cloud function dispatch crashes server via prototype chain traversal
Baja
CVE-2026-32943
Parse Server has a password reset token single-use bypass via concurrent requests
Alta
CVE-2026-32944
Parse Server crash via deeply nested query condition operators
Media
CVE-2026-27978
Next.js: null origin can bypass Server Actions CSRF checks
Baja
CVE-2026-27977
Next.js: null origin can bypass dev HMR websocket CSRF checks
Alta
CVE-2026-32980
OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion
Alta
CVE-2026-32728
Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
Media
CVE-2026-32723
SandboxJS has an execution-quota bypass (cross-sandbox currentTicks race) in SandboxJS timers
Baja
CVE-2026-32638
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
Alta
CVE-2026-29112
Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter
Media
CVE-2026-32630
file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry
Crítica
CVE-2026-22172
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
Media
CVE-2026-32924
OpenClaw: Feishu reaction events could bypass group authorization and mention gating
Alta
CVE-2026-1526
Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression
Alta
CVE-2026-2229
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
Alta
CVE-2026-1528
Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.