Alta
CVE-2026-11417
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 236
Restablecer filtros
Baja
CVE-2026-65901
DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects
Media
CVE-2026-49458
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
Media
CVE-2026-49459
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
Media
CVE-2026-82661
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
Alta
CVE-2026-54268
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
Media
CVE-2026-53655
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
Alta
CVE-2026-50171
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
Alta
CVE-2026-48017
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
Media
CVE-2026-47250
MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration
Alta
CVE-2026-50287
@agenticmail/mcp Missing Authentication for Critical Function
Alta
CVE-2026-44495
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Alta
CVE-2026-44705
tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
Media
CVE-2026-44644
LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
Media
CVE-2026-8723
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
Crítica
CVE-2026-46339
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
Crítica
CVE-2026-45353
Electerm Local code through electerm's single-instance socket
Alta
CVE-2026-45136
claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh
Crítica
CVE-2026-42074
OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input
Crítica
Explotada en ataques
CVE-2026-45321
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
Alta
CVE-2026-44728
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
Alta
CVE-2026-44721
open-webui Vulnerable to Stored XSS via Model Description
Crítica
ghsa-54pg-9963-v8vg
Compromised version of intercom-client published to npm
Alta
CVE-2026-44240
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.