Crítica
CVE-2026-31237
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.593
Crítica
CVE-2026-31239
mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub
Crítica
CVE-2026-31238
Ludwig framework is vulnerable to insecure deserialization in its model serving component
Crítica
CVE-2026-31234
Horovod contains an insecure deserialization vulnerability in its KVStore HTTP server component
Alta
CVE-2026-31221
PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization
Alta
CVE-2026-41284
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
Baja
CVE-2026-43514
Apache Tomcat - AJP secret compared in non-constant time
Crítica
CVE-2026-43512
Apache Tomcat - Digest authenticator will authenticate any unknown user
Alta
CVE-2026-43513
Apache Tomcat: LockOutRealm treats user names as case-sensitive
Crítica
CVE-2026-43515
Apache Tomcat - Security constraints not correctly applied
Alta
CVE-2026-42498
Apache Tomcat - WebSocket authentication header exposure
Crítica
CVE-2026-41293
Apache Tomcat - HTTP/2 request headers not validated
Crítica
CVE-2026-31220
PySyft server-side arbitrary Python execution after code approval
Crítica
CVE-2025-65719
Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page
Alta
CVE-2026-43891
changedetection.io has an Arbitrary Local File Read via a crafted backup restore
Alta
CVE-2026-41895
changedetection.io project has an XXE vulnerability
Media
CVE-2026-6965
Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter
Alta
CVE-2026-6929
JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter
Media
CVE-2025-14033
ilGhera Support System for WooCommerce <= 1.3.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Crítica
CVE-2026-42074
OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input
Media
CVE-2026-6962
Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Media
CVE-2026-7619
Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter
Media
CVE-2025-9988
Broadstreet <= 1.53.1 - Missing Authorization to Authenticated (Subscriber+) Advertiser Creation
Media
CVE-2026-42073
OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.