Alta
CVE-2026-58195
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 919
Restablecer filtros
Alta
CVE-2026-12151
undici WebSocket client vulnerable to denial of service via fragment count bypass
Crítica
CVE-2026-54051
Network-AI: Improper Neutralization of Special Elements used in an OS Command
Alta
CVE-2026-64657
budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL
Alta
CVE-2026-57494
AgenticMail: Cross-agent task authorization bypass in AgenticMail API
Alta
CVE-2026-9675
undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
Crítica
CVE-2026-57138
npm PraisonAI codeMode sandbox escape via Function constructor
Alta
CVE-2026-55388
piscina: Prototype Pollution Gadget → RCE via inherited options.filename
Baja
CVE-2026-56317
Cross-site scripting via <NoScript> slot content in Nuxt's head components
Media
CVE-2026-54306
n8n: Prototype Pollution enables confused-deputy execution via public webhooks
Media
CVE-2026-54308
n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes
Media
CVE-2026-54288
hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`
Alta
CVE-2026-50146
Astro: Reflected XSS via unescaped slot name
Media
CVE-2026-53722
Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
Alta
CVE-2026-53721
Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher
Media
CVE-2026-48988
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
Media
CVE-2026-54270
protobufjs: Memory amplification from preserved unknown fields in binary decode
Crítica
CVE-2026-53633
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Baja
CVE-2026-65900
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
Media
CVE-2026-49978
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
Media
CVE-2026-65902
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
Media
CVE-2026-49458
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
Media
CVE-2026-49459
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
Media
CVE-2026-82660
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.