Media
CVE-2026-101900
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 423
Restablecer filtros
Alta
CVE-2026-101909
Axios: Prototype Pollution Gadget in axios toFormData Options
Media
CVE-2026-101911
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
Alta
CVE-2026-102276
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
Media
CVE-2026-100702
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
Media
ghsa-253c-mchw-3w2r
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
Alta
CVE-2026-77426
Unleash: Missing await on permission check + cross-project IDOR in admin API
Media
CVE-2026-58272
Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)
Media
CVE-2026-81176
Svelte devalue: DoS via malformed input
Alta
CVE-2026-86038
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
Alta
CVE-2026-85715
ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion
Media
CVE-2026-61793
Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
Alta
CVE-2026-59960
@argos-ci/core: CI Branch Name OS Command Injection
Crítica
CVE-2026-88062
OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
Alta
CVE-2026-86075
n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
Alta
CVE-2026-59160
@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run
Alta
CVE-2026-85730
smol-toml: Denial of Service via malformed TOML documents
Alta
CVE-2026-92596
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
Media
CVE-2026-92597
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain
Alta
CVE-2026-77078
multer vulnerable to Denial of Service via crafted multipart field names
Baja
CVE-2026-77063
multer vulnerable to file size limit bypass via async fileFilter race condition
Alta
CVE-2026-82333
multer vulnerable to Denial of Service via oversized array index in field names
Alta
CVE-2026-83613
xmldom: Quadratic-time attribute deduplication
Crítica
CVE-2026-85061
MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.