Media
CVE-2026-64644
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 421
Restablecer filtros
Media
CVE-2026-72769
n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service
Alta
CVE-2026-59879
Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
Media
CVE-2026-67319
Axios: Nested axios option objects can consume polluted prototype values
Media
CVE-2026-67318
Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
Media
CVE-2026-67317
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
Media
CVE-2026-59875
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
Alta
CVE-2026-13311
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
Media
CVE-2026-67312
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
Media
CVE-2026-53496
ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes
Alta
CVE-2026-53597
Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader
Media
CVE-2026-54546
TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard
Alta
CVE-2026-50289
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
Alta
CVE-2026-49866
libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
Crítica
CVE-2026-53513
@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints
Alta
CVE-2026-67333
Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp
Media
CVE-2026-67332
@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators
Crítica
CVE-2026-49352
9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass
Alta
ghsa-vv65-f55v-xm6g
Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true)
Alta
CVE-2026-49987
repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection
Alta
CVE-2026-49864
wetty vulnerable to DOM XSS via file-download filename
Alta
CVE-2026-49857
auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback
Media
CVE-2026-50029
js-toml has silent type confusion via falsy-primitive duplicate-key bypass
Crítica
CVE-2026-48170
scimPatch vulnerable to prototype pollution via unfiltered keys in patch
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.