Crítica
CVE-2026-41501
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.593
Media
ghsa-39h7-pwv7-rc3x
Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)
Alta
CVE-2026-41325
Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection
Media
CVE-2026-41426
pretalx mail templates vulnerable to email injection via unescaped user-controlled placeholders
Media
CVE-2026-41425
Authlib: Cross-site request forging when using cache
Crítica
CVE-2026-12537
Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses
Alta
CVE-2026-41066
lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files
Media
CVE-2026-42241
ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width
Alta
CVE-2026-6553
TYPO3 CMS Stores Cleartext Password in User Settings Module
Alta
CVE-2026-40068
Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution
Alta
CVE-2026-33524
Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization
Alta
CVE-2026-42239
Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover
Baja
CVE-2026-41498
Kimai has Missing Object-Level Authorization in the Team API
Media
CVE-2026-42202
nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields
Media
CVE-2026-42190
RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions
Alta
CVE-2026-41311
liquidjs has a Denial of Service via circular block reference in layout
Media
CVE-2026-40690
Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions
Media
CVE-2026-38743
Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record
Media
CVE-2026-41305
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
Alta
CVE-2026-40466
Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection
Alta
CVE-2026-41044
Apache ActiveMQ Vulnerable to Code Injection
Media
CVE-2026-41043
Apache ActiveMQ Vulnerable to Cross-site Scripting
Media
CVE-2025-62233
Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerability
Alta
CVE-2026-23902
Apache DolphinScheduler has an Incorrect Authorization Vulnerability
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.