Alta
CVE-2026-93748
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 7.474
Restablecer filtros
Alta
CVE-2026-93687
braces vulnerable to stack-exhaustion denial of service through deeply nested patterns
Alta
CVE-2026-91127
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
Alta
CVE-2026-77301
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
Media
CVE-2026-84992
md-editor-v3: XSS via fenced-code language rendering bypass
Alta
CVE-2026-77615
Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text
Media
CVE-2026-88976
@platejs/core HTML deserialization can trigger browser behavior during parsing
Media
CVE-2026-81176
Svelte devalue: DoS via malformed input
Alta
CVE-2026-86039
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
Alta
CVE-2026-86038
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
Alta
CVE-2026-85715
ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion
Alta
CVE-2026-63506
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
Media
CVE-2026-63225
Redocly CLI: Path traversal when using `split` command
Media
CVE-2026-77360
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass
Alta
CVE-2026-71538
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
Crítica
CVE-2026-63472
Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification
Media
CVE-2026-63461
Vendure: Shop API list queries can return non-public entities when filterOperator is OR
Alta
CVE-2026-63460
Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends
Alta
CVE-2026-63459
Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
Media
CVE-2026-61793
Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
Alta
CVE-2026-63671
@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
Alta
CVE-2026-68904
node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
Crítica
CVE-2026-61560
@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
Crítica
CVE-2026-61559
@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.