Media
CVE-2026-7859
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.563
Media
CVE-2026-10530
Pie Register – User Registration, Profiles & Content Restriction < 3.8.4.10 - Missing Authorization
Media
CVE-2026-4610
ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content
Media
CVE-2026-52701
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.2 - Missing Authorization
Media
CVE-2026-12397
Job Portal <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Email Disclosure
Media
CVE-2025-71378
Picklescan is missing detection when calling built-in Python cProfile.runctx
Alta
CVE-2025-71357
Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand
Alta
CVE-2025-71348
Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config
Alta
CVE-2026-56340
vLLM introduced enhanced protection for CVE-2025-62164
Media
CVE-2026-56304
picklescan vulnerable to arbitrary file create using logging.FileHandler
Media
CVE-2026-58203
pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size
Alta
CVE-2026-58201
Lokka: Azure Resource Manager URL path validation issue
Alta
CVE-2026-58200
@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing
Alta
CVE-2026-59152
LangSmith SDK TracingMiddleware: Arbitrary server-side file read
Media
CVE-2026-58266
Anki: User scripts in iframes have access to the internal Anki API
Media
CVE-2026-58198
ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer
Crítica
CVE-2026-56120
OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
Alta
CVE-2026-58500
appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)
Alta
CVE-2026-58499
EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id
Alta
ghsa-v3f4-w7r7-v3hm
Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests
Alta
CVE-2026-76238
stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)
Alta
CVE-2026-76237
stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)
Alta
CVE-2026-76236
stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)
Baja
CVE-2026-57481
parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.