Alta
CVE-2026-50287
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 920
Restablecer filtros
Alta
CVE-2026-44495
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Alta
CVE-2026-44494
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
Alta
CVE-2026-48527
HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint
Alta
CVE-2026-45617
LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex
Media
CVE-2026-44644
LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
Alta
CVE-2026-42462
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
Media
CVE-2026-39964
Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers
Alta
CVE-2026-28445
Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview
Alta
CVE-2026-46701
Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
Crítica
CVE-2026-46703
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
Alta
CVE-2026-46625
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
Media
CVE-2026-46548
NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)
Crítica
CVE-2026-46412
Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm
Alta
CVE-2026-45783
@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
Crítica
CVE-2026-46339
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
Media
CVE-2026-46341
Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching
Alta
CVE-2026-46426
Budibase: Unrestricted Upload of File with Dangerous Type
Alta
CVE-2026-46511
HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
Alta
CVE-2026-46396
Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover
Crítica
CVE-2026-46395
HAXcms: Private Key Disclosure via Broken HMAC Implementation
Media
CVE-2026-46496
HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft
Baja
ghsa-jgg6-4rpr-wfh7
Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp
Media
CVE-2026-45719
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.