Alta
CVE-2026-46510
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 919
Restablecer filtros
Alta
CVE-2026-45717
Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL
Alta
CVE-2026-45548
Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation
Media
CVE-2026-67335
Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE
Crítica
CVE-2026-45353
Electerm Local code through electerm's single-instance socket
Alta
CVE-2026-45665
Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order
Media
CVE-2026-45346
Open WebUI Has Stored Cross-Site Scripting in SVG Renderer
Alta
CVE-2026-45011
Apostrophe has stored XSS via javascript: URL in Image Widget Link
Alta
CVE-2026-45012
Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget
Crítica
CVE-2026-44990
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
Media
ghsa-9m65-766c-r333
TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function
Crítica
CVE-2026-46442
FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
Alta
CVE-2026-45136
claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh
Alta
CVE-2026-44724
Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
Crítica
CVE-2026-42074
OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input
Crítica
CVE-2026-45091
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
Alta
CVE-2026-44290
protobuf.js: Process-wide denial of service through unsafe option paths
Alta
CVE-2026-44289
protobuf.js: Denial of service through unbounded protobuf recursion
Crítica
Explotada en ataques
CVE-2026-45321
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
Crítica
CVE-2026-43898
SandboxJS has a sandbox escape via Function.caller leakage of internal call op
Crítica
CVE-2026-25244
WebdriverIO BrowserStack Service has a Command Injection issue
Crítica
CVE-2026-44643
Angular Expressions - Remote Code Execution using filters
Alta
CVE-2026-45061
Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)
Alta
ghsa-mhwj-73qx-jqxm
@theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.