Baja
CVE-2026-44589
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 109
Restablecer filtros
Alta
ghsa-jxh8-jh77-xh6g
@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts
Alta
CVE-2026-42260
open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`
Alta
CVE-2026-43893
exiftool-vendored vulnerable to argument injection via newline characters in tag names
Alta
CVE-2026-42033
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
Media
CVE-2026-42041
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
Alta
CVE-2026-42449
n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders
Crítica
CVE-2026-41265
Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
Media
ghsa-fpw4-p57j-hqmq
Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization
Media
ghsa-p7mm-r948-4q3q
Paperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId` in paperclip server
Media
ghsa-3pw3-v88x-xj24
Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath
Baja
CVE-2026-43529
OpenClaw: TOCTOU read in exec script preflight
Alta
CVE-2026-34784
Parser Server's streaming file download bypasses afterFind file trigger authorization
Alta
CVE-2026-34524
SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root
Alta
CVE-2026-34603
@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions
Alta
CVE-2026-34573
parse-server has GraphQL complexity validator exponential fragment traversal DoS
Crítica
CVE-2026-34532
parse-server has cloud function validator bypass via prototype chain traversal
Alta
CVE-2026-33894
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
Media
CVE-2026-82866
PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled
Alta
CVE-2026-30939
Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution
Alta
CVE-2026-32913
OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects
Media
ghsa-8cp7-rp8r-mg77
OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP
Media
CVE-2026-32052
OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text
Media
CVE-2026-32022
OpenClaw safeBins grep -e File Read Bypass (stdin-only policy bypass)
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.