Media
CVE-2026-63667
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 764
Restablecer filtros
Media
CVE-2026-82417
qs: Denial of Service via Attacker Controlled isBuffer
Alta
CVE-2026-82392
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
Alta
CVE-2026-82393
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
Alta
CVE-2026-55641
9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF
Alta
CVE-2026-55609
consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write
Media
CVE-2026-76845
adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite
Alta
CVE-2026-61824
Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors
Media
CVE-2026-63466
Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username
Alta
ghsa-ghvf-qf6h-g8x5
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
Alta
CVE-2026-54156
node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
Alta
CVE-2026-54155
node-opcua missing nonce verification in UserNameIdentityToken authentication
Media
CVE-2026-55410
NocoBase backup restore schema name allows command injection
Media
CVE-2026-59992
Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)
Media
ghsa-hjwh-xvfw-qrwj
SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses
Alta
CVE-2026-53957
Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint
Alta
ghsa-2mf3-mr2r-r4vf
@rhinostone/swig: arbitrary local file read via include/extends path traversal
Alta
CVE-2026-69148
MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
Media
CVE-2026-53766
chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots
Crítica
CVE-2026-92960
vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
Alta
CVE-2026-19693
extract-zip allows arbitrary file writes through symlink archive entries
Alta
CVE-2026-40345
DeepmergeTS has stack exhaustion when merging recursive object graphs
Media
CVE-2026-55087
ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header
Crítica
CVE-2026-71851
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.