Alta
CVE-2026-41641
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 537
Restablecer filtros
Alta
CVE-2026-41693
i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite
Media
CVE-2026-41692
i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes
Media
CVE-2026-41691
i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns
Alta
CVE-2026-41690
i18next-http-middleware: Prototype pollution and path traversal via user-controlled language and namespace parameters
Media
CVE-2026-41067
Astro: XSS in define:vars via incomplete </script> tag sanitization
Media
CVE-2026-40155
Auth0 Next.js SDK has Improper Proxy Cache Lookup
Alta
CVE-2026-40931
Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing
Crítica
ghsa-vr7g-88fq-vhq3
Paperclip: OS Command Injection via Execution Workspace cleanupCommand
Alta
ghsa-xfqj-r5qw-8g4j
Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode
Crítica
CVE-2026-41428
Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints
Alta
CVE-2026-41423
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
Alta
CVE-2026-41138
Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.
Crítica
CVE-2026-41248
Official Clerk JavaScript SDKs: Middleware-based route protection bypass
Alta
CVE-2026-41180
PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart
Crítica
CVE-2026-33808
@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Crítica
CVE-2026-33807
@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes
Alta
ghsa-26wg-9xf2-q495
Novu has a XSS sanitization bypass
Alta
ghsa-4x48-cgf9-q33f
Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
Baja
ghsa-x7mm-9vvv-64w8
unhead: Streaming SSR `streamKey` injected into inline script without identifier validation
Crítica
CVE-2026-41679
paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
Media
CVE-2026-40299
next-intl has an open redirect vulnerability
Alta
ghsa-q4gf-8mx6-v5v3
Next.js has a Denial of Service with Server Components
Media
CVE-2026-35040
fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.