Alta
CVE-2026-32014
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 2.499
Restablecer filtros
Media
ghsa-5847-rm3g-23mw
OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants
Crítica
CVE-2026-28466
OpenClaw Vulnerable to Remote Code Execution via Node Invoke Approval Bypass in Gateway
Alta
CVE-2026-32062
OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure
Baja
CVE-2026-32020
OpenClaw's Control UI Static File Handler Follows Symlinks and Allows Out-of-Root File Read
Crítica
CVE-2026-28794
`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization
Crítica
CVE-2026-27971
Qwik vulnerable to Unauthenticated RCE via server$ Deserialization
Alta
CVE-2026-28787
OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay
Media
CVE-2026-28359
NocoDB Vulnerable to Stored Cross-site Scripting via Rich Text Field
Alta
ghsa-5c6j-r48x-rmvq
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
Media
CVE-2026-27638
@actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode
Alta
CVE-2026-27970
Angular i18n vulnerable to Cross-Site Scripting
Alta
CVE-2026-27959
Koa has Host Header Injection via ctx.hostname
Baja
CVE-2026-27942
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
Media
CVE-2026-27901
Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
Alta
CVE-2026-27903
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
Alta
CVE-2026-27904
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
Media
CVE-2026-27837
dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform()
Alta
CVE-2026-27818
TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist
Alta
CVE-2026-27148
Storybook Dev Server is Vulnerable to WebSocket Hijacking
Crítica
CVE-2026-27804
Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter
Media
CVE-2026-27795
LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader
Crítica
CVE-2026-27739
Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline
Media
CVE-2026-27738
Angular SSR has an Open Redirect via X-Forwarded-Prefix
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.