Media
CVE-2026-8681
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.593
Alta
CVE-2026-2652
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and
Media
CVE-2026-42677
WP Document Revisions <= 3.8.1 - Missing Authorization
Alta
CVE-2021-47965
WP Super Edit <= 2.5.4 - Unauthenticated Arbitrary File Upload
Media
CVE-2026-42676
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 3.0.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Media
CVE-2026-42675
Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.41 - Missing Authorization
Media
CVE-2026-45438
Smart Coupons For WooCommerce Coupons < 2.3.0 - Missing Authorization
Media
CVE-2025-4202
Multicollab: Content Team Collaboration and Editorial Workflow <= 5.2 - Missing Authorization to Authenticated (Subscriber+) Collaboration Comment
Crítica
CVE-2026-45411
vm2 Has a Sandbox Breakout Using Async Generator
Crítica
CVE-2026-45369
utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol
Alta
CVE-2026-46509
@ranfdev/deepobj has a Prototype Pollution vulnerability
Media
CVE-2026-45366
@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol
Crítica
CVE-2026-45288
Marten has an injection vulnerability in its full-text search regConfig parameter
Crítica
ghsa-wf8q-wvv8-p8jf
@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation
Media
ghsa-f3cj-j4f6-wq85
Svelte: SSR XSS via Insecure Promise Serialization in hydratable
Media
CVE-2026-45787
electerm's encrypt method not safe enough
Crítica
CVE-2026-45353
Electerm Local code through electerm's single-instance socket
Crítica
CVE-2026-45311
DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval
Alta
CVE-2026-45310
DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool
Media
CVE-2026-42573
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
Media
CVE-2026-42567
Svelte: ReDoS in `<svelte:element>` Tag Validation
Alta
CVE-2026-45665
Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order
Alta
CVE-2026-56398
Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
Alta
CVE-2026-45395
Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.