Baja
CVE-2026-43514
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.587
Crítica
CVE-2026-43512
Apache Tomcat - Digest authenticator will authenticate any unknown user
Alta
CVE-2026-43513
Apache Tomcat: LockOutRealm treats user names as case-sensitive
Crítica
CVE-2026-43515
Apache Tomcat - Security constraints not correctly applied
Alta
CVE-2026-42498
Apache Tomcat - WebSocket authentication header exposure
Crítica
CVE-2026-41293
Apache Tomcat - HTTP/2 request headers not validated
Crítica
CVE-2026-31220
PySyft server-side arbitrary Python execution after code approval
Crítica
CVE-2025-65719
Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page
Alta
CVE-2026-43891
changedetection.io has an Arbitrary Local File Read via a crafted backup restore
Alta
CVE-2026-41895
changedetection.io project has an XXE vulnerability
Media
CVE-2026-6965
Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter
Alta
CVE-2026-6929
JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter
Media
CVE-2025-14033
ilGhera Support System for WooCommerce <= 1.3.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Crítica
CVE-2026-42074
OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input
Media
CVE-2026-6962
Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Media
CVE-2026-7619
Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter
Media
CVE-2025-9988
Broadstreet <= 1.53.1 - Missing Authorization to Authenticated (Subscriber+) Advertiser Creation
Media
CVE-2026-42073
OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS
Media
CVE-2025-9987
Broadstreet <= 1.53.1 - Authenticated (Subscriber+) Information Disclosure
Media
CVE-2025-9989
Broadstreet <= 1.53.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Media
CVE-2026-7051
Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter
Media
CVE-2025-14755
Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference
Crítica
CVE-2026-45091
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
Alta
CVE-2026-44295
protobuf.js: Code injection in pbjs static output from crafted schema names
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.