Media
CVE-2026-32878
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.602
Alta
CVE-2026-32886
Parse Server's Cloud function dispatch crashes server via prototype chain traversal
Baja
CVE-2026-32943
Parse Server has a password reset token single-use bypass via concurrent requests
Alta
CVE-2026-32944
Parse Server crash via deeply nested query condition operators
Media
CVE-2026-32636
ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash
Crítica
CVE-2026-31938
jsPDF has HTML Injection in New Window paths
Alta
CVE-2026-31898
jsPDF has a PDF Object Injection via FreeText color
Alta
CVE-2026-31891
Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()
Alta
CVE-2026-33013
Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices
Media
CVE-2026-31865
Elysia Cookie Value Prototype Pollution
Media
CVE-2026-29057
Next.js: HTTP request smuggling in rewrites
Media
CVE-2026-27980
Next.js: Unbounded next/image disk cache growth can exhaust storage
Media
CVE-2026-27979
Next.js: Unbounded postponed resume buffering can lead to DoS
Alta
CVE-2026-21886
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to all
Media
CVE-2026-27978
Next.js: null origin can bypass Server Actions CSRF checks
Baja
CVE-2026-27977
Next.js: null origin can bypass dev HMR websocket CSRF checks
Media
CVE-2026-1780
[CR]Paid Link Manager <= 0.5 - Reflected Cross-Site Scripting
Media
CVE-2026-1926
Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation
Media
CVE-2026-4268
WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings
Media
CVE-2026-28563
Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dep
Alta
CVE-2026-30911
Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve,
Alta
CVE-2026-28779
Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.
Media
CVE-2026-26929
Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a
Baja
CVE-2026-4202
Broken Access Control in extension "Redirect Tab" (redirect_tab)
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.