Crítica
CVE-2026-59873
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 144
Restablecer filtros
Alta
CVE-2026-61836
Directus: Authorization-dependent response served from unsegmented cache key
Alta
CVE-2026-54504
@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default
Alta
CVE-2026-67331
@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers
Alta
CVE-2026-53518
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive
Alta
CVE-2026-53516
Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email
Media
CVE-2026-67332
@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators
Crítica
CVE-2026-53486
Decompress: Archive extraction can create files and links outside of the target directory
Media
CVE-2026-50017
pnpm binds unscoped user-level npm auth credentials to a repository-selected registry
Crítica
CVE-2026-48797
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
Alta
CVE-2026-57494
AgenticMail: Cross-agent task authorization bypass in AgenticMail API
Media
CVE-2026-65898
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
Alta
CVE-2026-57133
npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
Alta
CVE-2026-57137
npm PraisonAI AgentLoop onToolCall approval runs after tool execution
Crítica
CVE-2026-57140
npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation
Alta
CVE-2026-57136
npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
Crítica
CVE-2026-57138
npm PraisonAI codeMode sandbox escape via Function constructor
Alta
CVE-2026-57135
npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
Alta
CVE-2026-57134
npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
Media
CVE-2026-82661
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
Media
CVE-2026-82660
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization
Alta
CVE-2026-12143
form-data: CRLF injection in form-data via unescaped multipart field names and filenames
Media
CVE-2026-53655
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
Alta
CVE-2026-48034
@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.