Crítica
CVE-2026-41679
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.593
Media
CVE-2026-40301
rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives
Media
CVE-2026-40306
DNN: Same HostGUID for all new installs
Media
CVE-2026-40305
DNN: Force Friend Request Acceptance
Media
CVE-2026-40299
next-intl has an open redirect vulnerability
Crítica
CVE-2026-40258
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
Alta
ghsa-75hx-xj24-mqrw
n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport
Baja
CVE-2026-40194
phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals()
Alta
CVE-2026-40321
DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload
Alta
ghsa-6v7q-wjvx-w8wg
basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands
Media
CVE-2026-40190
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`
Media
CVE-2026-39921
GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outboun
Media
CVE-2026-39922
GeoNode contains a server-side request forgery vulnerability in the service registration endpoint
Media
ghsa-vj8v-p5vw-m6v5
xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern
Alta
CVE-2026-40177
ajenti.plugin.core has password bypass when 2FA is activated
Media
CVE-2026-40175
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Baja
ghsa-xq4j-g85q-wf97
REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)
Baja
ghsa-m662-8jrj-cw6v
REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required)
Baja
CVE-2026-114110
uv vulnerable to arbitrary file deletion through RECORD entries
Crítica
CVE-2026-40289
PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions
Crítica
CVE-2026-40288
PraisonAI has critical RCE via `type: job` workflow YAML
Alta
CVE-2026-40287
PraisonAI Vulnerable to RCE via Automatic tools.py Import
Baja
ghsa-59xv-588h-2vmm
@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler
Alta
CVE-2026-40163
Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.