Baja
CVE-2026-34224
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 419
Restablecer filtros
Alta
CVE-2026-33941
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
Media
CVE-2026-34043
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
Media
CVE-2026-33993
Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()
Alta
CVE-2026-33979
Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)
Alta
CVE-2026-33895
Forge has signature forgery in Ed25519 due to missing S > L check
Alta
CVE-2026-33285
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
Baja
CVE-2026-33624
Parse Server: MFA recovery code single-use bypass via concurrent requests
Media
CVE-2026-29772
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
Media
CVE-2026-82866
PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled
Media
CVE-2026-82864
PDFME Affected by Decompression Bomb in FlateDecode Stream Parsing Causes Memory Exhaustion DoS
Alta
CVE-2026-32887
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
Alta
CVE-2026-32701
Qwik City has array method pollution in FormData processing allows type confusion and DoS
Alta
CVE-2026-33228
Prototype Pollution via parse() in NodeJS flatted
Alta
CVE-2026-32730
ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
Alta
CVE-2026-33143
OneUptime WhatsApp Webhook Missing Signature Verification
Media
CVE-2026-82867
Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas
Alta
CVE-2026-32763
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.
Media
CVE-2026-1525
Undici has an HTTP Request/Response Smuggling issue
Crítica
CVE-2026-32304
Locutus vulnerable to RCE via unsanitized input in create_function()
Alta
CVE-2026-32141
flatted vulnerable to unbounded recursion DoS in parse() revive phase
Crítica
CVE-2026-26954
SandboxJS affected by a Sandbox Escape
Alta
CVE-2026-32101
StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
Alta
CVE-2026-31975
@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.