Media
CVE-2026-33171
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.593
Alta
CVE-2026-33172
Statamic has Stored XSS via SVG Sanitization Bypass
Alta
CVE-2026-33166
Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)
Alta
CVE-2026-33163
Parse Server leaks protected fields via LiveQuery afterEvent trigger
Crítica
CVE-2026-32731
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
Alta
CVE-2026-32730
ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
Media
CVE-2026-3475
Instant Popup Builder <= 1.1.7 - Unauthenticated Arbitrary Shortcode Execution via 'token' Parameter
Media
CVE-2026-30048
NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability
Alta
CVE-2026-33001
Jenkins has a link following vulnerability allows arbitrary file creation
Alta
CVE-2026-33002
Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation
Media
CVE-2026-33004
Jenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form
Media
CVE-2026-33003
Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files
Alta
CVE-2026-32634
Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers
Media
CVE-2026-32632
Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding
Alta
CVE-2026-32611
Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements
Media
CVE-2026-4068
Add Custom Fields to Media <= 2.0.3 - Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter
Media
CVE-2026-4006
Draft List <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'display_name' Parameter
Alta
CVE-2026-33151
socket.io allows an unbounded number of binary attachments
Alta
CVE-2026-33143
OneUptime WhatsApp Webhook Missing Signature Verification
Alta
CVE-2026-32610
Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
Alta
CVE-2026-33142
OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters
Media
CVE-2026-86253
h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read
Alta
CVE-2026-33131
h3 has a middleware bypass with one gadget
Media
CVE-2026-33129
h3 has an observable timing discrepancy in basic auth utils
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.