Alta
CVE-2026-43946
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 537
Restablecer filtros
Alta
CVE-2026-43945
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
Alta
CVE-2026-28445
Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview
Baja
CVE-2026-9520
Blitz has a Cross-site Scripting issue
Crítica
CVE-2026-46703
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
Crítica
CVE-2026-46695
BoxLite: Permission Bypass Allows Modification of Read-Only Files
Media
CVE-2026-56268
Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows
Alta
CVE-2026-46417
@angular/platform-server: SSRF via Hostname Hijacking
Crítica
CVE-2026-46339
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
Alta
CVE-2026-46426
Budibase: Unrestricted Upload of File with Dangerous Type
Media
CVE-2026-45669
Nuxt: Reflected XSS in `navigateTo()` external redirect
Alta
CVE-2026-45302
parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names
Crítica
CVE-2026-45411
vm2 Has a Sandbox Breakout Using Async Generator
Crítica
ghsa-wf8q-wvv8-p8jf
@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation
Alta
CVE-2026-45665
Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order
Crítica
CVE-2026-46442
FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
Alta
CVE-2026-45109
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
Baja
CVE-2026-44572
Next.js's Middleware / Proxy redirects can be cache-poisoned
Media
CVE-2026-44581
Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces
Baja
CVE-2026-44582
Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting
Media
CVE-2026-44580
Next.js has cross-site scripting in beforeInteractive scripts with untrusted input
Alta
CVE-2026-44579
Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components
Media
CVE-2026-44577
Next.js has a Denial of Service in the Image Optimization API
Alta
CVE-2026-44578
Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.