Media
CVE-2026-88059
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 7.474
Restablecer filtros
Media
CVE-2026-88057
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
Alta
CVE-2026-86082
n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
Alta
CVE-2026-86081
n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
Alta
CVE-2026-86075
n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
Alta
CVE-2026-86076
n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
Alta
ghsa-x7m8-jrm8-hpvx
@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name
Alta
CVE-2026-59179
@openhop/server: Path Traversal in Flow ID File Operations
Alta
CVE-2026-59176
functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import
Alta
CVE-2026-59160
@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run
Alta
CVE-2026-59158
Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients
Alta
CVE-2026-85730
smol-toml: Denial of Service via malformed TOML documents
Media
CVE-2026-86996
n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy
Media
CVE-2026-92598
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain
Alta
CVE-2026-92596
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
Media
CVE-2026-92597
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain
Alta
ghsa-2q42-4q24-7rgv
OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree
Alta
CVE-2026-77078
multer vulnerable to Denial of Service via crafted multipart field names
Alta
CVE-2026-77037
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
Baja
CVE-2026-77063
multer vulnerable to file size limit bypass via async fileFilter race condition
Alta
CVE-2026-82333
multer vulnerable to Denial of Service via oversized array index in field names
Media
CVE-2026-15603
morgan vulnerable to Log Forging via unescaped Unicode line separators
Crítica
ghsa-26w7-cxv4-gfx2
Astro: Remote code execution through AVIF image optimization
Media
CVE-2026-84376
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.