Alta
CVE-2026-43866
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 310
Restablecer filtros
Baja
ghsa-j6hm-v3x2-qv6j
land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory
Baja
CVE-2026-49989
CrateDB's Blob HTTP handler bypasses authorization
Alta
CVE-2026-45794
OpenAM has Unsafe Java Deserialization via SNS
Alta
CVE-2026-54512
jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation
Alta
ghsa-m4w9-hjfw-vwj4
http4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`
Media
CVE-2026-55847
Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering
Media
CVE-2026-55414
NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)
Media
CVE-2026-50009
Netty: QUIC stateless reset token material exposed through header-visible connection IDs
Alta
CVE-2026-40998
Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource
Media
CVE-2026-41721
Spring Data Commons: Denial of Service via excessive memory allocation in projection binding
Alta
CVE-2026-40993
Spring Security SAML2 Service Provider is vulnerable to Deserialization of Untrusted Data via JdbcAssertingPartyMetadataRepository
Baja
CVE-2026-41694
Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout Payloads
Alta
CVE-2026-40988
Spring Security SAML2 Service Provider: Unbounded writer inflates the compressed SAML payload into memory (DoS)
Alta
CVE-2026-44890
Netty has Unbounded Direct Memory Consumption in its RedisDecoder
Alta
CVE-2026-44250
Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays
Alta
CVE-2026-47695
CC-Tweaked has an SSRF Protection Bypass with NAT64
Crítica
CVE-2026-46621
Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection
Crítica
CVE-2026-46562
Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override
Crítica
CVE-2026-44632
Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`
Alta
CVE-2026-45799
Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service
Crítica
CVE-2026-45091
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
Alta
CVE-2026-42587
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS
Alta
CVE-2026-42583
Netty Lz4FrameDecoder is vulnerable to resource exhaustion
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.