Media
CVE-2026-39408
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.593
Media
CVE-2026-39407
Hono: Middleware bypass via repeated slashes in serveStatic
Media
CVE-2026-39406
@hono/node-server: Middleware bypass via repeated slashes in serveStatic
Media
CVE-2026-39398
openclaw-claude-bridge: sandbox is not effective - `--allowed-tools ""` does not restrict available tools
Crítica
CVE-2026-39397
@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections
Alta
CVE-2026-39356
Drizzle ORM has SQL injection via improperly escaped SQL identifiers
Media
CVE-2026-39381
Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`
Media
CVE-2026-35583
Emissary has a Path Traversal via Blacklist Bypass in Configuration API
Alta
CVE-2026-35581
Emissary has a Command Injection via PLACE_NAME Configuration in Executrix
Crítica
CVE-2026-35580
Emissary has GitHub Actions Shell Injection via Workflow Inputs
Alta
CVE-2026-39371
RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests
Alta
CVE-2026-39370
WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)
Alta
CVE-2026-39369
WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs
Media
CVE-2026-39368
WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services
Media
CVE-2026-39367
WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page
Media
CVE-2026-39366
WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php
Media
ghsa-5g3j-89fr-r2vp
skilleton has improper input handling in repository/path processing
Media
CVE-2026-39321
Parse Server has a login timing side-channel reveals user existence
Baja
CVE-2026-5751
justhtml: Mutation XSS with custom foreign-namespace sanitization policies
Media
CVE-2026-35613
coursevault-preview has a path traversal due to improper base-directory boundary validation
Alta
ghsa-69x8-hrgq-fjj8
LiteLLM: Password hash exposure and pass-the-hash authentication bypass
Alta
CVE-2026-39555
Askka - Candle Shop WordPress Theme <= 1.3.1 - Unauthenticated PHP Object Injection
Media
CVE-2026-45215
EasyPay <= 4.3.0 - Unauthenticated Information Exposure
Media
CVE-2026-2519
Online Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.