Crítica
ghsa-v6wj-c83f-v46x
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 423
Restablecer filtros
Crítica
CVE-2026-44008
vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`
Baja
CVE-2026-44589
nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)
Alta
CVE-2026-43998
vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape
Crítica
CVE-2026-43999
vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape
Crítica
CVE-2026-44005
vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
Crítica
CVE-2026-44006
vm2 has a Sandbox Escape Vulnerability
Media
CVE-2026-44437
Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix
Crítica
CVE-2026-44351
fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver
Baja
ghsa-r27j-894h-3w3p
mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`
Alta
CVE-2026-42334
Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
Alta
ghsa-jxh8-jh77-xh6g
@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts
Baja
CVE-2026-43930
parse-server: MFA SMS one-time password accepted twice under concurrent login
Alta
CVE-2026-42856
Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls
Crítica
CVE-2026-26956
VM2 Has a WASM Sandbox Escape
Crítica
CVE-2026-24781
VM2 Has Sandbox Breakout Through Inspect Function
Media
CVE-2026-42039
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Media
CVE-2026-42042
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
Alta
CVE-2026-42043
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
Alta
CVE-2026-42353
i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters
Media
CVE-2026-45001
OpenClaw: Agent gateway config mutations could change protected operator settings
Media
CVE-2026-41907
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
Alta
CVE-2026-41673
xmldom: Uncontrolled recursion in XML serialization leads to DoS
Alta
CVE-2026-41640
@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.