Crítica
CVE-2026-70477
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 759
Restablecer filtros
Media
CVE-2026-73603
Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials
Crítica
CVE-2026-69264
Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
Crítica
CVE-2026-69255
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
Media
CVE-2026-69207
Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
Media
CVE-2026-69198
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
Alta
CVE-2026-18446
fast-uri vulnerable to host confusion via backslash authority introducer
Alta
CVE-2026-69152
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
Alta
CVE-2026-53608
@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag
Alta
CVE-2026-58263
Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
Alta
ghsa-p7w7-4929-vpj5
`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation
Media
ghsa-xrmj-5g4g-8987
@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification
Media
ghsa-pqh8-p93p-2rx7
@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL
Baja
ghsa-pc2w-4mq8-32qw
@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate
Alta
CVE-2026-54664
swagger-typescript-api vulnerable to code injection via unescaped enum string values
Media
CVE-2026-54663
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`
Media
CVE-2026-52888
NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
Alta
CVE-2026-54545
@wakaru/cli arbitrary file write during bundle unpack
Crítica
CVE-2026-73567
sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
Media
CVE-2026-73307
Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
Alta
CVE-2026-73410
Budibase: SSRF via DNS rebinding in the REST datasource integration
Media
CVE-2026-73306
Budibase: Account Enumeration via Login Lockout Response Differential
Alta
CVE-2026-73406
Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
Crítica
CVE-2026-73407
Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.