Media
CVE-2026-39408
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 112
Restablecer filtros
Media
CVE-2026-39407
Hono: Middleware bypass via repeated slashes in serveStatic
Media
CVE-2026-39406
@hono/node-server: Middleware bypass via repeated slashes in serveStatic
Alta
CVE-2026-41303
OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals
Alta
CVE-2026-35641
OpenClaw has an Arbitrary Malicious Code Execution Vulnerability
Alta
CVE-2026-34076
Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
Media
CVE-2026-35658
OpenClaw: Image Tool `tools.fs.workspaceOnly` Bypass via Sandbox Bridge Mounts
Baja
CVE-2026-35649
OpenClaw: Tlon settings empty-allowlist reconciliation bypassed intended revocation
Media
CVE-2026-56763
Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })
Crítica
CVE-2026-28292
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
Media
ghsa-9q2p-vc84-2rwm
OpenClaw: system.run allow-always persistence included shell-commented payload tails
Alta
CVE-2026-29087
@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
Media
CVE-2026-29086
Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()
Media
CVE-2026-29085
Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()
Alta
CVE-2026-29045
Hono vulnerable to arbitrary file access via serveStatic vulnerability
Media
CVE-2026-32002
OpenClaw's image tool bypasses tools.fs.workspaceOnly on sandbox mount paths and exfiltrates out-of-workspace images
Alta
ghsa-9f72-qcpw-2hxc
OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs
Alta
CVE-2026-27700
Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
Baja
CVE-2026-56764
Hono added timing comparison hardening in basicAuth and bearerAuth
Media
CVE-2026-24771
Hono vulnerable to XSS through ErrorBoundary component
Media
CVE-2026-24473
Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)
Media
CVE-2026-24472
Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception
Media
CVE-2026-24398
Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing
Alta
CVE-2026-22818
Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.