Alta
CVE-2026-34784
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 7.523
Restablecer filtros
Alta
CVE-2026-34752
Haraka affected by DoS via `__proto__` email header
Alta
CVE-2026-34725
dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration
Media
ghsa-x3ff-w252-2g7j
StableLib Ed25519 Signature Malleability via Missing S < L Check
Media
CVE-2026-34750
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
Media
CVE-2026-34526
SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6
Alta
CVE-2026-34524
SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root
Media
CVE-2026-34523
SillyTavern: Path Traversal allows file existence oracle
Alta
CVE-2026-34522
SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory
Media
CVE-2026-34749
Payload has a CSRF Protection Bypass in Authentication Flow
Alta
CVE-2026-34746
Payload has Authenticated SSRF via Upload Functionality
Alta
CVE-2026-34748
@payloadcms/next has Stored XSS in Admin Panel
Alta
CVE-2026-34747
Payload has an SQL Injection via Query Handling
Media
CVE-2026-34451
Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories
Media
CVE-2026-2265
Replicator deserializes untrusted user input
Crítica
CVE-2026-34751
Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery
Alta
CVE-2026-34604
@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions
Alta
CVE-2026-34603
@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions
Alta
CVE-2026-34601
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
Media
CVE-2026-34595
Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value
Media
CVE-2026-34574
Parse Server has a session field immutability bypass via falsy-value guard
Crítica
CVE-2026-41294
OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover
Alta
CVE-2026-41380
OpenClaw gateway exec allow-always over-trusts positional carrier executables
Baja
CVE-2026-34504
OpenClaw affected by SSRF via unguarded image download in fal provider
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.