Total alertas: 196

--- TOP 10 alertas por severidad ---
[critical] CVE-2026-33937
  pkg: handlebars (npm)
  summary: Handlebars.js has JavaScript Injection via AST Type Confusion
  cvss: 9.8
  state: open

[critical] CVE-2026-32621
  pkg: @apollo/query-planner (npm)
  summary: Apollo Federation vulnerable to prototype pollution via incomplete key sanitization
  cvss: 9.9
  state: open

[critical] CVE-2026-32621
  pkg: @apollo/gateway (npm)
  summary: Apollo Federation vulnerable to prototype pollution via incomplete key sanitization
  cvss: 9.9
  state: open

[critical] CVE-2026-32621
  pkg: @apollo/federation-internals (npm)
  summary: Apollo Federation vulnerable to prototype pollution via incomplete key sanitization
  cvss: 9.9
  state: open

[critical] CVE-2026-25896
  pkg: fast-xml-parser (npm)
  summary: fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
  cvss: 9.3
  state: open

[    high] CVE-2026-42033
  pkg: axios (npm)
  summary: Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hi
  cvss: 7.4
  state: open

[    high] CVE-2026-42035
  pkg: axios (npm)
  summary: Axios: Header Injection via Prototype Pollution
  cvss: 7.4
  state: open

[    high] CVE-2026-42043
  pkg: axios (npm)
  summary: Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopb
  cvss: 7.2
  state: open

[    high] CVE-2026-42264
  pkg: axios (npm)
  summary: Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential inje
  cvss: 7.4
  state: open

[    high] CVE-2026-33671
  pkg: picomatch (npm)
  summary: Picomatch has a ReDoS vulnerability via extglob quantifiers
  cvss: 7.5
  state: open

