Crítica
CVE-2026-31871
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 561
Restablecer filtros
Crítica
CVE-2026-31856
Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL
Crítica
CVE-2026-31862
@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters
Media
CVE-2026-31828
Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction
Alta
CVE-2026-30951
Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type
Alta
CVE-2026-30945
StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service
Alta
CVE-2026-31861
@siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes
Alta
CVE-2026-30944
StudioCMS has Privilege Escalation via Insecure API Token Generation
Alta
CVE-2026-25041
@budibase/server: Command Injection in PostgreSQL Dump Command
Alta
CVE-2026-30823
Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration
Alta
CVE-2026-30822
Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint
Baja
CVE-2026-30830
defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag
Alta
CVE-2026-29783
GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution
Media
CVE-2026-56267
Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint
Media
CVE-2026-56272
Flowise has Insufficient Password Salt Rounds
Media
CVE-2025-64166
Mercurius: Incorrect Content-Type parsing can lead to CSRF attack
Alta
CVE-2026-29074
SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)
Alta
CVE-2026-29063
Immutable is vulnerable to Prototype Pollution
Media
CVE-2026-29086
Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()
Media
CVE-2026-31995
OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path
Baja
ghsa-8mf7-vv8w-hjr2
OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode
Media
ghsa-796m-2973-wc5q
OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation
Media
ghsa-r294-2894-92j3
OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering
Alta
CVE-2026-32063
OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.