Crítica
CVE-2026-39397
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 537
Restablecer filtros
Alta
CVE-2026-35394
@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url
Media
CVE-2026-34777
Electron: Incorrect origin passed to permission request handler for iframe requests
Alta
CVE-2026-34748
@payloadcms/next has Stored XSS in Admin Panel
Alta
CVE-2026-34603
@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions
Alta
CVE-2026-34601
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
Media
CVE-2026-33580
OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication
Media
CVE-2026-35628
OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret
Media
CVE-2026-65914
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization
Alta
CVE-2026-34076
Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
Alta
CVE-2026-33989
@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools
Alta
ghsa-vj2p-7pgw-g2wf
Postiz App has a High-Severity SSRF Vulnerability via Next.js
Alta
CVE-2026-33894
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
Media
ghsa-9q82-xgwf-vj6h
Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention
Baja
CVE-2026-35624
OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens
Media
CVE-2026-33768
Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`
Media
CVE-2026-33732
srvx is vulnerable to middleware bypass via absolute URI in request line
Baja
CVE-2026-33490
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
Media
CVE-2026-82866
PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled
Alta
CVE-2026-32887
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
Media
CVE-2026-33397
Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR
Crítica
ghsa-wvr4-3wq4-gpc5
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint
Crítica
CVE-2026-32731
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
Alta
CVE-2026-33143
OneUptime WhatsApp Webhook Missing Signature Verification
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.