Conoce las vulnerabilidades. Protege tus aplicaciones.

Alta 20.10.2026

CVE-2026-113666

ApostropheCMS: Eliminación de miembros del prototipo por exclusión de proyección en @apostrophecms/db-connect causa denegación de servicio

ApostropheCMS permite a usuarios autenticados en adaptadores SQLite o PostgreSQL eliminar métodos de prototipo compartidos mediante proyecciones de exclusión, provocando una denegación de servicio persistente en todo el proceso.

npm

apostrophe, @apostrophecms/db-connect

Baja 07.10.2026

CVE-2026-106101

Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

npm

quasar

Media 05.10.2026

CVE-2026-104844

PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

npm

postcss-selector-parser

Crítica 05.10.2026

CVE-2026-104848

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

npm

tinypool

Crítica 05.10.2026

CVE-2026-104849

Tinypool: Prototype Pollution Gadget to RCE in run() options

npm

tinypool

Crítica 02.10.2026

CVE-2026-114088

Trigger.dev: V1 coordinator default-secret unauth Socket.IO

npm

trigger.dev

Alta 18.09.2026

CVE-2026-77301

adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

npm

adm-zip

Crítica 15.09.2026

CVE-2026-61568

@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

npm

@zereight/mcp-gitlab

Alta 02.09.2026

CVE-2026-65842

Plate: SSRF with response disclosure in DOCX image embedding

npm

@platejs/docx-io

Media 02.09.2026

CVE-2026-82562

qs array-limit bypass via bracket-key comma parsing

npm

qs

Media 02.09.2026

CVE-2026-82417

qs: Denial of Service via Attacker Controlled isBuffer

npm

qs

Alta 19.08.2026

CVE-2026-53957

Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

npm

@contentful/mcp-server, @contentful/mcp-tools

Alta 04.08.2026

CVE-2026-70473

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

npm

flowise

Media 20.07.2026

CVE-2026-67316

Axios: Prototype pollution gadgets can alter axios request construction

npm

axios

Media 19.06.2026

CVE-2026-9679

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

npm

undici

Alta 18.06.2026

CVE-2026-55388

piscina: Prototype Pollution Gadget → RCE via inherited options.filename

npm

piscina

Media 17.06.2026

CVE-2026-54325

Pi Agent: Pi loads project-local extensions without approval

npm

@earendil-works/pi-coding-agent

Alta 15.06.2026

CVE-2026-49982

tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template

npm

tmp

Alta 29.05.2026

CVE-2026-44495

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

npm

axios

Alta 29.05.2026

CVE-2026-44494

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

npm

axios

Media 22.05.2026

CVE-2026-8723

qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set

npm

qs

Media 11.05.2026

CVE-2026-41159

Mermaid: Improper sanitization of configuration leads to CSS injection

npm

mermaid

Alta 05.05.2026

CVE-2026-42035

Axios: Header Injection via Prototype Pollution

npm

axios

Media 05.05.2026

CVE-2026-42044

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

npm

axios