Media
CVE-2026-33916
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 920
Restablecer filtros
Baja
CVE-2026-33769
Astro: Remote allowlist bypass via unanchored matchPathname wildcard
Media
CVE-2026-33532
yaml is vulnerable to Stack Overflow via deeply nested YAML collections
Media
CVE-2026-30587
Seafile Server has multiple stored XSS vulnerabilities
Alta
CVE-2026-33287
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
Alta
CVE-2026-33285
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
Media
CVE-2026-29772
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
Alta
ghsa-g3qj-j598-cxmq
fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing
Media
CVE-2026-86250
H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service
Media
CVE-2026-86251
h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`
Alta
CVE-2026-33468
Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings
Media
CVE-2026-33429
Parse Server has a protected field change detection oracle via LiveQuery watch parameter
Media
CVE-2026-82865
PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel
Media
CVE-2026-82864
PDFME Affected by Decompression Bomb in FlateDecode Stream Parsing Causes Memory Exhaustion DoS
Alta
CVE-2026-32887
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
Alta
CVE-2026-33331
oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
Crítica
ghsa-wvr4-3wq4-gpc5
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint
Alta
CVE-2026-33163
Parse Server leaks protected fields via LiveQuery afterEvent trigger
Crítica
CVE-2026-32731
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
Alta
CVE-2026-33143
OneUptime WhatsApp Webhook Missing Signature Verification
Media
CVE-2026-82868
Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas
Alta
CVE-2026-32763
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.
Alta
CVE-2026-32256
music-metadata has an infinite loop vulnerability in ASF parser
Crítica
CVE-2026-31938
jsPDF has HTML Injection in New Window paths
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.