Baja
CVE-2026-48011
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.587
Media
CVE-2026-48010
Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts
Media
CVE-2026-48009
Shopware: Admin Account Takeover via User Recovery Hash Exposure
Media
CVE-2026-48008
Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass
Crítica
CVE-2026-54458
WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
Media
CVE-2026-50183
WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section
Media
CVE-2026-50182
WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination
Alta
CVE-2026-49279
WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)
Alta
CVE-2026-47696
WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint
Media
CVE-2026-47694
WWBN AVideo: Stored XSS via unescaped Gallery category description
Crítica
CVE-2026-50076
Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path
Media
CVE-2026-47676
Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
Media
CVE-2026-47674
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
Media
CVE-2026-47675
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
Media
CVE-2026-47673
Hono: JWT middleware accepts any Authorization scheme, not only Bearer
Media
CVE-2026-47672
epa4all-client: Unauthenticated REST API for Patient Record Writes
Alta
CVE-2026-34077
React Router vulnerable to Denial of Service via reflected user input in single-fetch
Media
CVE-2026-47707
Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
Media
CVE-2026-47706
Strawberry GraphQL has a Circular Fragment Reference DOS
Baja
CVE-2026-45739
Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs
Alta
CVE-2026-45337
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
Alta
CVE-2026-44496
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Alta
CVE-2026-44488
Allocation of Resources Without Limits or Throttling in Axios
Alta
CVE-2026-44487
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.