Media
CVE-2026-90988
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.534
Media
CVE-2026-87973
If-So Dynamic Content 1.9.9 - 1.10.1 - Authenticated (Editor+) Stored Cross-Site Scripting
Media
CVE-2026-96173
Payments for Hubtel <= 1.0.1 - Unauthenticated Insecure Direct Object Reference
Media
CVE-2026-85004
Popup Maker WP <= 1.4.5 - Missing Authorization
Crítica
CVE-2026-19253
Cache Enabler <= 1.8.16 - Unauthenticated Arbitrary File and Directory Deletion
Media
CVE-2026-86610
Download Manager <= 3.3.70 - Authenticated (Author+) Stored Cross-Site Scripting
Media
CVE-2026-13413
CMP - Coming Soon & Maintenance <= 4.1.19 - Unauthenticated Maintenance Mode Bypass
Media
CVE-2026-92412
Five Star Restaurant Reviews <= 2.3.13 - Reflected Cross-Site Scripting
Media
CVE-2026-100701
Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure
Media
CVE-2026-85024
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
Media
CVE-2026-88932
multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
Media
CVE-2026-87859
morgan vulnerable to Log Injection via unescaped double quote in quoted log fields
Alta
CVE-2026-101895
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
Alta
CVE-2026-84292
fast-uri vulnerable to authority injection via an unvalidated port in serialize
Alta
CVE-2026-84394
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
Media
CVE-2026-102275
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
Media
CVE-2026-83557
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)
Media
CVE-2026-101913
ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
Media
CVE-2026-101910
ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
Alta
CVE-2026-88058
Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
Alta
CVE-2026-68497
jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS
Media
CVE-2026-19032
jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution
Media
CVE-2026-77310
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization
Media
CVE-2026-101914
@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.