Media
CVE-2026-31865
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.593
Media
CVE-2026-29057
Next.js: HTTP request smuggling in rewrites
Media
CVE-2026-27980
Next.js: Unbounded next/image disk cache growth can exhaust storage
Media
CVE-2026-27979
Next.js: Unbounded postponed resume buffering can lead to DoS
Alta
CVE-2026-21886
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to all
Media
CVE-2026-27978
Next.js: null origin can bypass Server Actions CSRF checks
Baja
CVE-2026-27977
Next.js: null origin can bypass dev HMR websocket CSRF checks
Media
CVE-2026-1780
[CR]Paid Link Manager <= 0.5 - Reflected Cross-Site Scripting
Media
CVE-2026-1926
Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation
Media
CVE-2026-4268
WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings
Media
CVE-2026-28563
Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dep
Alta
CVE-2026-30911
Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve,
Alta
CVE-2026-28779
Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.
Media
CVE-2026-26929
Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a
Baja
CVE-2026-4202
Broken Access Control in extension "Redirect Tab" (redirect_tab)
Alta
CVE-2026-4208
Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)
Alta
CVE-2026-4258
sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey
Media
CVE-2026-25009
Education Zone <= 1.3.8 - Missing Authorization
Alta
CVE-2026-25457
Mixtape <= 2.1 - Unauthenticated Local File Inclusion
Media
CVE-2026-25456
Automated FedEx live/manual rates with shipping labels – HPOS supported <= 5.1.8 - Missing Authorization
Media
CVE-2026-40742
Nelio AB Testing <= 8.2.8 - Unauthenticated Information Exposure
Alta
CVE-2026-2992
KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard
Alta
CVE-2026-25449
Travel Booking WordPress Theme < 3.2.8.1 - Unauthenticated PHP Object Injection
Alta
CVE-2026-24378
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.0 - Unauthenticated PHP Object Injection
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.