Alta
CVE-2026-44895
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 82
Restablecer filtros
Media
CVE-2026-44214
eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fields
Media
CVE-2026-44373
Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules`
Alta
CVE-2026-42260
open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`
Media
CVE-2026-35041
fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification
Media
CVE-2026-33732
srvx is vulnerable to middleware bypass via absolute URI in request line
Media
CVE-2026-86205
H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation
Media
CVE-2026-86250
H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service
Media
CVE-2026-86252
h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)
Baja
CVE-2026-33490
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
Media
CVE-2026-86251
h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`
Media
CVE-2026-86253
h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read
Alta
CVE-2026-33131
h3 has a middleware bypass with one gadget
Media
CVE-2026-33129
h3 has an observable timing discrepancy in basic auth utils
Alta
CVE-2026-33128
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
Crítica
CVE-2026-30921
OneUptime: Synthetic Monitor RCE via exposed Playwright browser object
Media
ghsa-f6h3-846h-2r8w
OpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization
Alta
ghsa-7ff8-xjh3-mgh6
OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt
Crítica
ghsa-cr3w-cw5w-h3fj
Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE
Alta
ghsa-h3hw-29fv-2x75
@envelop/graphql-modules has a Race Condition vulnerability
Alta
CVE-2026-23527
h3 v1 has Request Smuggling (TE.TE) issue
Alta
ghsa-96qw-h329-v5rg
Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles
Alta
CVE-2025-69256
serverless MCP Server vulnerable to Command Injection in list-projects tool
Alta
CVE-2025-71399
Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.