Baja
CVE-2026-92962
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 419
Restablecer filtros
Alta
CVE-2026-44495
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Media
CVE-2026-44646
LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
Media
CVE-2026-44645
LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
Media
CVE-2026-8723
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
Alta
CVE-2026-46679
js-libp2p: Memory DoS via subscription flood of unique topics
Alta
CVE-2026-45783
@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
Crítica
CVE-2026-46339
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
Alta
ghsa-hv85-774v-26fg
auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs
Alta
CVE-2026-46393
HAXcms createSite SSRF Enables Arbitrary File Read
Media
CVE-2026-45736
ws: Uninitialized memory disclosure
Alta
CVE-2026-8161
multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception
Alta
CVE-2026-45302
parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names
Media
CVE-2026-45149
brace-expansion: Large numeric range defeats documented `max` DoS protection
Alta
CVE-2026-42570
Svelte devalue: DoS via sparse array deserialization
Alta
CVE-2026-46444
FlowiseAI: Vector Store No Permission Checks
Alta
CVE-2026-44724
Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
Crítica
Explotada en ataques
CVE-2026-45321
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
Alta
CVE-2026-44635
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`
Media
CVE-2026-44577
Next.js has a Denial of Service in the Image Optimization API
Crítica
ghsa-v6wj-c83f-v46x
@profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module
Crítica
CVE-2026-44008
vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`
Baja
CVE-2026-44589
nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)
Alta
CVE-2026-43998
vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.