Media
CVE-2026-70610
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 113
Restablecer filtros
Media
CVE-2026-69207
Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
Media
CVE-2026-65841
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
Crítica
CVE-2026-54658
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
Alta
CVE-2026-73410
Budibase: SSRF via DNS rebinding in the REST datasource integration
Alta
CVE-2026-72855
Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution
Media
CVE-2026-73565
Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake
Media
CVE-2026-59896
hono/jsx does not isolate context per request, leading to cross-request data disclosure
Media
CVE-2026-59895
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
Media
CVE-2026-59897
Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
Media
ghsa-frvp-7c67-39w9
Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
Media
CVE-2026-73423
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
Media
CVE-2026-67318
Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
Media
CVE-2026-67332
@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators
Baja
CVE-2026-53835
OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement
Crítica
CVE-2026-48714
i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names
Alta
CVE-2026-57495
AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)
Alta
CVE-2026-9697
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
Alta
CVE-2026-82659
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
Alta
CVE-2026-57135
npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
Media
CVE-2026-54288
hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`
Media
CVE-2026-54289
hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
Alta
CVE-2026-54290
hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
Media
CVE-2026-54286
hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.