Alta
CVE-2026-41699
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.587
Alta
CVE-2026-41700
Spring for GraphQL: Cross-Site WebSocket Hijacking
Alta
CVE-2026-40999
Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations
Alta
CVE-2026-40994
Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default
Media
CVE-2026-40995
Spring Web Services: X.509 authentication bypasses Spring Security account checks
Baja
CVE-2026-41000
Spring Web Services: WSS4J validation does not use configured replay cache
Alta
CVE-2026-40998
Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource
Media
CVE-2026-40996
Spring Web Services: Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default
Media
CVE-2026-40997
Spring Web Services: SOAP security faults leak Spring Security account state
Media
CVE-2026-40986
Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML
Media
CVE-2026-40992
Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname Verification
Alta
CVE-2026-40987
Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem
Media
CVE-2026-40985
Spring Web Flow has Data Binding Vulnerability with Unified EL Parser
Alta
CVE-2026-10142
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by
Alta
CVE-2026-10143
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by suppl
Alta
CVE-2026-6379
WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection
Media
CVE-2026-9067
Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload
Crítica
CVE-2026-11976
MonsterInsights Pro 10.2.2, 10.2.0 - Unauthenticated Backdoor
Alta
CVE-2026-3326
XStore < 9.7.3 - Unauthenticated SQL Injection
Alta
CVE-2026-5776
Email Encoder – Protect Email Addresses and Phone Numbers < 2.4.7 - Unauthenticated Stored Cross-Site Scripting
Media
CVE-2026-1631
Feeds for YouTube (YouTube video, channel, and gallery plugin) < 2.6.4 - Missing Authorization
Media
CVE-2026-11781
Adminify <= 4.2.9 - Authenticated (Contributor+) Information Exposure
Alta
CVE-2026-7385
Decent Comments < 3.0.2 - Unauthenticated Information Exopsure
Media
CVE-2026-6268
EventPress < 22.2 - Reflected Cross-Site Scripting
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.