Alta
CVE-2026-42137
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.593
Baja
ghsa-mqq7-wxx5-mp8h
ps_checkout allows unauthorized method invocation through unvalidated parameter
Crítica
CVE-2026-7567
Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover
Crítica
CVE-2026-42354
Sentry's improper authentication on SAML SSO process allows user identity linking
Media
CVE-2026-42191
OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter
Media
CVE-2026-36766
Shopizer is vulnerable to Cross-site Scripting
Crítica
CVE-2026-36767
Shopizer has a path traversal issue
Alta
CVE-2026-36340
Krayin CRM allows a remote attacker to execute arbitrary code via compose email function
Alta
CVE-2026-42349
Clerk has an authorization bypass when combining organization, billing, or reverification checks
Alta
CVE-2026-42449
n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders
Alta
CVE-2026-40171
Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
Media
CVE-2024-13362
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Media
CVE-2026-7500
Keycloak has a Forced Browsing issue
Media
CVE-2026-41016
apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider
Media
CVE-2026-7446
mcp-server-semgrep has a Command Injection issue
Media
CVE-2026-3143
Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation
Alta
CVE-2026-42774
JetEngine <= 3.8.8.1 - Unauthenticated SQL Injection
Media
CVE-2026-3140
Ultimate Dashboard <= 3.8.14 - Cross-Site Request Forgery to Module Activation/Deactivation
Alta
CVE-2026-3772
WP Editor <= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor
Media
CVE-2026-6127
Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
Media
CVE-2026-41686
Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool
Alta
CVE-2026-42353
i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters
Alta
CVE-2026-41680
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer
Media
CVE-2026-41671
Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.