Baja
CVE-2026-46553
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.593
Media
CVE-2026-46552
NocoDB: Shared-base link access can invite arbitrary users as persistent base members
Media
CVE-2026-46551
NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion
Media
CVE-2026-46550
NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags
Baja
CVE-2026-46549
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation
Media
CVE-2026-46548
NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)
Media
CVE-2026-46547
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL
Alta
CVE-2026-46519
MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement
Alta
CVE-2026-46643
Snappy: Binary path is never shell-escaped due to an inverted is_executable check
Media
CVE-2026-46683
Snappy : SSRF and local file read via the xsl-style-sheet option
Media
CVE-2026-46616
Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers
Alta
CVE-2026-8679
AudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter
Media
CVE-2026-7615
Widget Context <= 1.3.3 - Cross-Site Request Forgery to Settings Update via 'wl' Parameter
Media
CVE-2026-8692
Vedrixa Forms <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Structure Modification via wefb_save_form_structure AJAX Action
Media
CVE-2026-7636
Slider by Soliloquy <= 2.8.1 - Authenticated (Subscriber+) Information Disclosure via REST API Endpoint
Media
CVE-2026-8684
MotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action
Media
CVE-2026-7798
FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter
Media
CVE-2026-15285
The Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes
Alta
CVE-2026-9011
Ditty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action
Media
CVE-2026-82258
@sveltejs/kit: `query.batch` cross-talk
Alta
CVE-2026-46492
md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)
Alta
CVE-2026-46490
samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions
Alta
CVE-2026-46481
OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users
Media
CVE-2026-4070
Alfie <= 1.2.1 - Cross-Site Request Forgery to Feed Deletion via 'delete' Parameter
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.