Alta
CVE-2026-61824
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 757
Restablecer filtros
Media
CVE-2026-63466
Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username
Alta
ghsa-ghvf-qf6h-g8x5
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
Alta
CVE-2026-54156
node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
Alta
CVE-2026-54155
node-opcua missing nonce verification in UserNameIdentityToken authentication
Media
CVE-2026-55410
NocoBase backup restore schema name allows command injection
Media
CVE-2026-59992
Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)
Media
ghsa-hjwh-xvfw-qrwj
SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses
Alta
CVE-2026-53957
Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint
Alta
ghsa-2mf3-mr2r-r4vf
@rhinostone/swig: arbitrary local file read via include/extends path traversal
Alta
CVE-2026-69148
MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
Media
CVE-2026-53766
chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots
Crítica
CVE-2026-92960
vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
Alta
CVE-2026-19693
extract-zip allows arbitrary file writes through symlink archive entries
Alta
CVE-2026-40345
DeepmergeTS has stack exhaustion when merging recursive object graphs
Media
CVE-2026-55087
ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header
Crítica
CVE-2026-71851
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
Media
CVE-2026-71498
node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript
Media
CVE-2026-71430
node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length
Alta
ghsa-5p4m-2wfm-xmqj
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
Alta
CVE-2026-71476
Nx: Zip-Slip in the self-hosted remote cache
Alta
CVE-2026-71316
Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
Crítica
CVE-2026-70477
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
Media
CVE-2026-73603
Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.