Media
CVE-2026-41335
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 920
Restablecer filtros
Baja
CVE-2026-47099
TeleJSON: DOM XSS via unsanitised constructor name in `new Function()`
Crítica
CVE-2026-34950
fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key
Alta
CVE-2026-34752
Haraka affected by DoS via `__proto__` email header
Alta
CVE-2026-34725
dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration
Media
CVE-2026-34750
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
Alta
CVE-2026-34522
SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory
Media
CVE-2026-34749
Payload has a CSRF Protection Bypass in Authentication Flow
Alta
CVE-2026-34746
Payload has Authenticated SSRF via Upload Functionality
Alta
CVE-2026-34748
@payloadcms/next has Stored XSS in Admin Panel
Alta
CVE-2026-34747
Payload has an SQL Injection via Query Handling
Crítica
CVE-2026-34751
Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery
Alta
CVE-2026-34601
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
Alta
CVE-2026-33949
@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files
Media
CVE-2026-35664
OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing
Baja
CVE-2026-73427
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)
Media
CVE-2026-65914
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization
Alta
CVE-2026-33940
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
Alta
CVE-2026-33939
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
Alta
CVE-2026-33938
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
Media
CVE-2026-56358
n8n has a Stored XSS Vulnerability in its Form Trigger
Media
CVE-2026-33994
Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521
Media
CVE-2026-33993
Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()
Alta
CVE-2026-33943
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.