Conoce las vulnerabilidades. Protege tus aplicaciones.

Alta 20.10.2026

CVE-2026-113658

ApostropheCMS: Las solicitudes no autenticadas de importación de CSV dejan cargas rechazadas en el directorio temporal del sistema

Las solicitudes no autenticadas de importación de CSV en ApostropheCMS dejan archivos rechazados en el directorio temporal del sistema. Atacantes remotos pueden aprovechar esto enviando repetidamente archivos grandes, agotando el espacio en disco y provocando una denegación de servicio.

npm

apostrophe

Media 20.10.2026

CVE-2026-113656

ApostropheCMS: Carga multipart no autenticada e ilimitada provoca DoS por agotamiento de disco

Atacantes no autenticados pueden enviar cuerpos multipart ilimitados al almacenamiento temporal en ApostropheCMS, provocando el agotamiento del espacio en disco y una denegación de servicio.

npm

@apostrophecms/form

Media 28.09.2026

CVE-2026-88932

multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads

npm

multer

Alta 08.09.2026

CVE-2026-77078

multer vulnerable to Denial of Service via crafted multipart field names

npm

multer

Alta 08.09.2026

CVE-2026-77037

multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

npm

multer

Baja 08.09.2026

CVE-2026-77063

multer vulnerable to file size limit bypass via async fileFilter race condition

npm

multer

Alta 08.09.2026

CVE-2026-82333

multer vulnerable to Denial of Service via oversized array index in field names

npm

multer

Media 19.08.2026

CVE-2026-59992

Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

npm

next-tinacms-azure, next-tinacms-cloudinary, next-tinacms-dos +1

Alta 18.06.2026

CVE-2026-55603

http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`

npm

http-proxy-middleware

Alta 17.06.2026

CVE-2026-5079

Multer vulnerable to Denial of Service via deeply nested field names

npm

multer

Media 17.06.2026

CVE-2026-5038

Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

npm

multer

Alta 14.05.2026

CVE-2026-46444

FlowiseAI: Vector Store No Permission Checks

npm

flowise

Alta 22.04.2026

CVE-2026-79743

MCPHub has Path Traversal via Malicious MCPB Manifest Name

npm

@samanhappy/mcphub

Alta 06.03.2026

CVE-2026-30821

Flowise has Arbitrary File Upload via MIME Spoofing

npm

flowise

Alta 05.03.2026

CVE-2026-3520

Multer Vulnerable to Denial of Service via Uncontrolled Recursion

npm

multer

Alta 01.03.2026

CVE-2026-3304

Multer vulnerable to Denial of Service via incomplete cleanup

npm

multer

Alta 01.03.2026

CVE-2026-2359

Multer vulnerable to Denial of Service via resource exhaustion

npm

multer

Alta 08.10.2025

CVE-2025-61687

FlowiseAI/Flosise has File Upload vulnerability

npm

flowise

Alta 17.07.2025

CVE-2025-7338

Multer vulnerable to Denial of Service via unhandled exception from malformed request

npm

multer

Alta 05.06.2025

CVE-2025-48997

Multer vulnerable to Denial of Service via unhandled exception

npm

multer

Alta 19.05.2025

CVE-2025-47944

Multer vulnerable to Denial of Service from maliciously crafted requests

npm

multer

Alta 19.05.2025

CVE-2025-47935

Multer vulnerable to Denial of Service via memory leaks from unclosed streams

npm

multer

Crítica 13.03.2025

CVE-2025-71333

Flowise Pre-auth Arbitrary File Upload

npm

flowise

Crítica 03.09.2020

ghsa-v95x-h953-x7fg

Malicious Package in k0a_multer

npm

k0a_multer