Alta
CVE-2026-55691
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.583
Alta
CVE-2026-55690
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text
Alta
CVE-2026-55091
flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key
Alta
CVE-2026-55849
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument
Alta
ghsa-v52w-28xh-v562
Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)
Alta
CVE-2026-54784
CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality
Alta
CVE-2026-54783
CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages
Crítica
CVE-2026-54782
CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
Alta
CVE-2026-54781
CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced
Baja
CVE-2026-54780
CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass
Media
CVE-2026-54779
CoreWCF: SAML token replay protection is inoperative
Media
CVE-2026-54778
CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
Media
CVE-2026-54777
CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance
Media
CVE-2026-54776
CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade
Media
CVE-2026-54775
CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.
Alta
CVE-2026-54774
CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate
Media
CVE-2026-54773
CoreWCF: WS-Security signature substitution via document-wide Signature lookup
Alta
CVE-2026-54772
CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake
Media
CVE-2026-12119
Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute
Alta
CVE-2026-11911
Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter
Alta
CVE-2026-11912
Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action
Baja
CVE-2026-55778
parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist
Alta
CVE-2026-54527
jupyterlab-git extension: Stored XSS leading to RCE
Media
CVE-2026-53726
parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.