Alta
CVE-2026-104847
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 7.472
Restablecer filtros
Media
CVE-2026-92936
vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting
Alta
CVE-2026-92942
vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
Crítica
CVE-2026-92946
vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
Crítica
CVE-2026-92947
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
Crítica
CVE-2026-92956
vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
Media
CVE-2026-74866
@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
Media
CVE-2026-103918
@orpc/zod: Prototype injection in smart coercion
Alta
CVE-2026-104861
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
Alta
CVE-2026-19481
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
Alta
CVE-2026-19484
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
Crítica
CVE-2026-10032
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
Media
CVE-2026-114073
Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values
Media
CVE-2026-114079
Trigger.dev: Cross-environment deployment cancel
Alta
CVE-2026-114081
Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
Media
CVE-2026-114086
Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId
Alta
CVE-2026-114087
Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
Alta
CVE-2026-96780
figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
Crítica
CVE-2026-114088
Trigger.dev: V1 coordinator default-secret unauth Socket.IO
Media
CVE-2026-114076
Trigger.dev: Blind SSRF via alert-channel webhook
Alta
ghsa-pp95-gc86-jq6q
Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
Alta
CVE-2026-85650
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
Alta
CVE-2026-85651
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
Media
CVE-2026-92952
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.