Media
CVE-2026-35619
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.602
Media
CVE-2026-35665
OpenClaw has incomplete Fix for CVE-2026-32011: Feishu Webhook Pre-Auth Body Parsing DoS (Slow-Body / Slowloris Variant)
Alta
CVE-2026-35668
OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)
Media
CVE-2026-35667
OpenClaw has incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in `!stop` Chat Command via `shell-utils.ts`
Alta
CVE-2026-34375
AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page
Media
CVE-2026-34373
GraphQL API endpoint ignores CORS origin restriction
Media
CVE-2026-34372
Sulu checks fix permissions for subentities endpoints
Media
CVE-2026-34369
AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification
Media
CVE-2026-34368
AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance
Media
CVE-2026-34364
AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php
Alta
CVE-2026-34363
LiveQuery protected field leak via shared mutable state across concurrent subscribers
Media
CVE-2026-34362
AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()
Media
CVE-2026-34237
MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)
Crítica
CVE-2026-34361
FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
Media
CVE-2026-34360
FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing
Alta
CVE-2026-34359
HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect
Crítica
CVE-2026-34156
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
Alta
CVE-2026-33949
@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files
Media
CVE-2026-1877
Auto Post Scheduler <= 1.84 - Cross-Site Request Forgery to Stored Cross-Site Scripting via aps_options_page
Media
CVE-2026-1834
Ibtana - WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Crítica
CVE-2026-27599
ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Media
CVE-2026-1797
Truebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files
Media
CVE-2026-1710
WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax
Media
CVE-2026-4146
Loco Translate <= 2.8.2 - Reflected Cross-Site Scripting via 'update_href' Parameter
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.