Baja
CVE-2026-65900
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 561
Restablecer filtros
Media
CVE-2026-82661
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
Media
CVE-2026-53655
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
Alta
CVE-2026-49982
tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template
Baja
ghsa-g7r4-m6w7-qqqr
esbuild allows arbitrary file read when running the development server on Windows
Alta
CVE-2026-48152
Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
Crítica
CVE-2026-48150
Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
Media
CVE-2026-48148
Budibase: Unvalidated VectorDB Host Parameter Enables SSRF
Media
CVE-2026-48121
LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access
Alta
CVE-2026-48054
OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri
Alta
CVE-2026-48017
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
Crítica
CVE-2026-47670
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
Crítica
CVE-2026-47668
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
Media
CVE-2026-47384
NocoDB: SQL Injection via Column Title in Bulk GroupBy
Media
CVE-2026-47380
NocoDB: User Enumeration via Sign-In Timing
Media
CVE-2026-47377
NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin
Alta
CVE-2026-34077
React Router vulnerable to Denial of Service via reflected user input in single-fetch
Alta
CVE-2026-44496
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Alta
CVE-2026-42342
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
Alta
CVE-2026-42211
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
Media
CVE-2026-40181
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
Media
CVE-2026-33244
React Router has stored XSS via unescaped Location header in prerendered redirect HTML
Alta
CVE-2026-47717
FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
Alta
CVE-2026-44705
tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.