Media
CVE-2026-73563
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 7.501
Restablecer filtros
Media
CVE-2026-73428
Trix: Stored XSS via HTMLParser attribute injection on paste
Media
CVE-2026-59952
Valibot: record() issue paths can make flatten() throw for inherited Object property names
Crítica
CVE-2026-59940
seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
Media
CVE-2026-82257
SvelteKit: Prototype pollution in file input deletion path in remote-function forms
Media
CVE-2026-82256
SvelteKit: Big remote form function payloads can cause Node process to crash
Alta
CVE-2026-67327
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in
Alta
CVE-2026-67329
@better-auth/stripe: cross-organization billing tampering in organization subscription actions
Crítica
CVE-2026-67330
@better-auth/scim: account takeover and stale access via SCIM provider-id collision
Alta
CVE-2026-55685
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
Alta
CVE-2026-55575
LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
Alta
CVE-2026-54673
electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
Alta
CVE-2026-54672
electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`
Media
CVE-2026-53669
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
Media
CVE-2026-53668
React Router: Open redirect leading to XSS
Media
CVE-2026-53667
React Router: RSCErrorHandler Missing Protocol Validation (XSS)
Media
CVE-2026-53666
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
Alta
CVE-2026-47219
find-my-way: DDoS with HTTP2
Alta
CVE-2026-45623
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
Crítica
CVE-2026-73421
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
Alta
CVE-2026-73418
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
Crítica
CVE-2026-73420
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
Media
CVE-2026-73419
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
Media
CVE-2026-16629
danger allows local OS command injection through crafted file paths
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.