Media
CVE-2026-39407
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 2.499
Restablecer filtros
Media
CVE-2026-39406
@hono/node-server: Middleware bypass via repeated slashes in serveStatic
Media
CVE-2026-39381
Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`
Alta
CVE-2026-39371
RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests
Media
CVE-2026-39321
Parse Server has a login timing side-channel reveals user existence
Alta
CVE-2026-34148
Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution
Media
CVE-2026-39365
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling
Alta
CVE-2026-39364
Vite: `server.fs.deny` bypassed with queries
Alta
CVE-2026-39363
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
Media
CVE-2026-35515
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
Alta
CVE-2026-35209
defu: Prototype pollution via `__proto__` key in defaults argument
Alta
ghsa-6q22-g298-grjh
Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver
Media
CVE-2026-35441
Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits
Alta
CVE-2026-35409
Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
Media
CVE-2026-35413
Directus: GraphQL Schema SDL Disclosure Setting
Media
CVE-2026-35410
Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow
Alta
CVE-2026-39942
Directus: Path Traversal and Broken Access Control in File Management API
Alta
CVE-2026-35408
Directus: Missing Cross-Origin Opener Policy
Crítica
CVE-2026-35216
Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step
Alta
CVE-2026-35214
Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write
Alta
CVE-2026-35394
@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url
Baja
CVE-2026-35200
Parse Server: File upload Content-Type override via extension mismatch
Alta
CVE-2026-25044
Budibase: Command Injection in Bash Automation Step
Media
CVE-2026-34211
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.