Media
CVE-2026-39389
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.593
Media
CVE-2026-40180
quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class
Sin evaluar
CVE-2026-6095
drupal/orejime - SA-CONTRIB-2026-032
Media
CVE-2026-39865
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
Media
CVE-2026-5600
A new API endpoint introduced in pretix 2025 that is supposed to
Media
CVE-2026-82853
Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)
Media
CVE-2026-39859
LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read
Media
CVE-2026-39412
LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
Media
CVE-2026-39411
LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header
Alta
CVE-2026-35525
LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates
Baja
CVE-2026-34166
LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter
Alta
CVE-2026-33229
XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API
Media
CVE-2026-5742
UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution
Crítica
CVE-2026-1830
Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload
Media
CVE-2026-4336
Ultimate FAQ Accordion Plugin <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via FAQ Content
Media
CVE-2026-5357
Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Media
CVE-2026-5711
Post Blocks & Tools <= 1.3.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'sliderStyle' Block Attribute
Alta
CVE-2026-5436
MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys
Media
CVE-2026-0811
Advanced CF7 DB <= 2.0.9 - Cross-Site Request Forgery to Form Entry Deletion
Media
CVE-2026-0814
Advanced CF7 DB <= 2.0.9 - Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel Export
Crítica
CVE-2026-2942
ProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess
Media
CVE-2026-39410
Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()
Media
CVE-2026-39409
Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
Media
CVE-2026-56762
Hono missing validation of cookie name on write path in setCookie()
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.