Media
CVE-2026-40175
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 919
Restablecer filtros
Baja
ghsa-59xv-588h-2vmm
@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler
Alta
CVE-2026-23869
React Server Components have a Denial of Service Vulnerability
Media
CVE-2026-39315
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()
Alta
ghsa-jf56-mccx-5f3f
OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
Alta
ghsa-5478-66c3-rhxr
Pretext: Algorithmic Complexity (DoS) in the text analysis phase
Media
CVE-2026-39411
LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header
Crítica
CVE-2026-39397
@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections
Media
CVE-2026-35613
coursevault-preview has a path traversal due to improper base-directory boundary validation
Media
ghsa-846p-hgpv-vphc
OpenClaw: QQ Bot structured payloads could read arbitrary local files
Media
CVE-2026-35515
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
Alta
CVE-2026-35209
defu: Prototype pollution via `__proto__` key in defaults argument
Alta
CVE-2026-35442
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
Crítica
CVE-2026-35216
Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
Alta
CVE-2026-106447
@stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags
Alta
CVE-2026-106448
@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding
Alta
CVE-2026-25044
Budibase: Command Injection in Bash Automation Step
Media
CVE-2026-34211
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
Crítica
CVE-2026-34208
SandboxJS: Sandbox integrity escape
Crítica
CVE-2026-35039
fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)
Baja
CVE-2026-35038
Signal K Server: Arbitrary Prototype Read via `from` Field Bypass
Media
CVE-2026-65912
DOMPurify ADD_ATTR predicate skips URI validation
Media
CVE-2026-41400
OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062)
Media
CVE-2026-41335
OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.