Conoce las vulnerabilidades. Protege tus aplicaciones.

Media 21.10.2026

CVE-2026-113800

Electron: las comprobaciones de permisos HID y USB pueden atribuirse al origen incorrecto

Un problema en Electron causa que las comprobaciones de permisos HID y USB desde un iframe se atribuyan al marco principal. Esto puede provocar que aplicaciones con lógica basada en el origen otorguen a marcos embebidos accesos destinados a la página principal.

npm

electron

Alta 07.10.2026

CVE-2026-106104

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

npm

quasar

Alta 05.10.2026

CVE-2026-102826

simple-git allows command execution through unblocked Git configuration includes

npm

simple-git

Media 29.09.2026

CVE-2026-102672

Electron: Local race condition in Squirrel.Mac update installation on macOS

npm

electron

Alta 29.09.2026

CVE-2026-102673

Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

npm

electron

Alta 29.09.2026

CVE-2026-102674

Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

npm

electron

Alta 29.09.2026

CVE-2026-102675

Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

npm

electron

Alta 29.09.2026

CVE-2026-102676

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

npm

electron

Alta 29.09.2026

CVE-2026-102677

Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

npm

electron

Media 05.08.2026

CVE-2026-70612

Electron: Sandboxed iframes can launch external protocol handlers

npm

electron

Media 05.08.2026

CVE-2026-70611

Electron: DevTools embedder handler executes arbitrary files via shell open

npm

electron

Media 05.08.2026

CVE-2026-70610

Electron: contextBridge object copy honors prototype setters

npm

electron

Media 05.08.2026

CVE-2026-70609

Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

npm

electron

Alta 05.08.2026

CVE-2026-70608

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

npm

electron

Media 05.08.2026

CVE-2026-70607

Electron: window.open features string controls some window options considered privileged

npm

electron

Media 05.08.2026

CVE-2026-70606

Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

npm

electron

Media 05.08.2026

CVE-2026-70605

Electron: HTTP redirect followed into local file loader

npm

electron

Alta 05.08.2026

CVE-2026-70604

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

npm

electron

Media 05.08.2026

CVE-2026-70602

Electron: Extension tab APIs operate across session boundaries

npm

electron

Media 05.08.2026

CVE-2026-70603

Electron: shell.openPath path validation bypass via embedded null byte

npm

electron

Alta 05.08.2026

CVE-2026-70601

Electron: Context isolation bypass via Function.prototype.bind hijack

npm

electron

Baja 05.08.2026

CVE-2026-70600

Electron: Cross-origin iframe can position native autofill popup

npm

electron

Media 05.08.2026

CVE-2026-70599

Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

npm

electron

Baja 05.08.2026

CVE-2026-70598

Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

npm

electron