Media
CVE-2026-23835
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 236
Restablecer filtros
Media
CVE-2026-23888
pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)
Media
CVE-2026-23889
pnpm has Windows-specific tarball Path Traversal
Media
CVE-2026-23890
pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin
Media
CVE-2026-24056
pnpm has symlink traversal in file:/git dependencies
Alta
CVE-2026-24132
Orval Mock Generation Code Injection via const
Alta
CVE-2026-0933
Wrangler affected by OS Command Injection in `wrangler pages deploy`
Alta
CVE-2026-23950
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
Alta
CVE-2026-23745
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
Media
CVE-2026-76231
Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies
Alta
CVE-2025-69264
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
Alta
CVE-2025-69262
pnpm vulnerable to Command Injection via environment variable substitution
Crítica
CVE-2025-66401
MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL
Alta
CVE-2025-66020
Valibot has a ReDoS vulnerability in `EMOJI_REGEX`
Media
CVE-2025-64765
Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
Alta
CVE-2025-64756
glob CLI: Command injection via -c/--cmd executes matches with shell:true
Alta
ghsa-m8jr-fxqx-8xx6
Apollo Federation has Improper Enforcement of Access Control on Transitive Fields
Alta
CVE-2025-64530
@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields
Alta
CVE-2025-64496
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
Crítica
CVE-2025-62410
happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript
Alta
CVE-2025-58754
Axios is vulnerable to DoS attack through lack of data size check
Baja
CVE-2025-46720
Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields
Alta
CVE-2024-12905
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File
Baja
ghsa-5pq3-h73f-66hr
AWS CDK CodePipeline: trusted entities are too broad
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.