Crítica
CVE-2026-29792
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 920
Restablecer filtros
Crítica
CVE-2026-28292
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
Alta
CVE-2026-30944
StudioCMS has Privilege Escalation via Insecure API Token Generation
Media
CVE-2026-30938
Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement
Media
ghsa-9q2p-vc84-2rwm
OpenClaw: system.run allow-always persistence included shell-commented payload tails
Baja
CVE-2026-27183
OpenClaw: system.run wrapper-depth boundary could skip shell approval gating
Media
ghsa-3h2q-j2v4-6w5r
OpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers
Crítica
CVE-2026-30887
OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE
Alta
CVE-2026-30821
Flowise has Arbitrary File Upload via MIME Spoofing
Media
ghsa-9r75-g2cr-3h76
Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens
Alta
CVE-2026-29063
Immutable is vulnerable to Prototype Pollution
Alta
CVE-2026-29091
locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection
Media
ghsa-9mph-4f7v-fmvh
OpenClaw has agent avatar symlink traversal in gateway session metadata
Alta
CVE-2026-27566
OpenClaw's exec allowlist wrapper analysis did not unwrap env/shell dispatch chains
Baja
ghsa-8mf7-vv8w-hjr2
OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode
Media
ghsa-796m-2973-wc5q
OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation
Alta
CVE-2026-32056
OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)
Media
CVE-2026-32017
OpenClaw exec allowlist safeBins short-option bypass could permit arbitrary file write
Alta
CVE-2026-22179
OpenClaw has macOS `system.run` allowlist bypass via quoted command substitution
Media
CVE-2026-29608
OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts
Media
ghsa-2858-xg23-26fp
OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots
Media
CVE-2026-28460
OpenClaw's system.run allowlist bypass via shell line-continuation command substitution
Media
CVE-2026-32052
OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text
Media
CVE-2026-0540
DOMPurify contains a Cross-site Scripting vulnerability
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.