Alta
CVE-2026-44721
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 74
Restablecer filtros
Alta
ghsa-g485-8j3v-p6x8
@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin
Alta
CVE-2026-41680
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer
Media
CVE-2026-39857
ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictions
Media
CVE-2026-33889
ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context
Crítica
CVE-2026-33808
@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
Media
CVE-2026-40190
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`
Alta
CVE-2026-35442
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
Crítica
CVE-2026-34208
SandboxJS: Sandbox integrity escape
Alta
CVE-2026-32635
Angular vulnerable to XSS in i18n attribute bindings
Crítica
CVE-2026-30956
OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover
Media
ghsa-r294-2894-92j3
OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering
Media
ghsa-2hm8-rqrm-xfjq
OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows
Media
CVE-2026-24472
Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception
Alta
CVE-2025-61914
n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox
Alta
CVE-2025-64495
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Alta
CVE-2025-54073
mcp-package-docs vulnerable to command injection in several tools
Media
CVE-2018-25110
Marked allows Regular Expression Denial of Service (ReDoS) attacks
Baja
CVE-2025-23206
AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider
Media
CVE-2024-39919
@jmondi/url-to-png enables capture screenshot of localhost web services (unauthenticated pages)
Alta
CVE-2024-31999
@fastify/secure-session: Reuse of destroyed secure session cookie
Media
CVE-2023-49798
OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4
Alta
CVE-2023-39345
Unauthorized Access to Private Fields in User Registration API
Alta
CVE-2022-24441
snyk Code Injection vulnerability
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.