Media
ghsa-ggxf-37hm-9wqf
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 1.999
Restablecer filtros
Media
CVE-2026-40864
JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)
Media
Explotada en ataques
CVE-2026-48710
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Crítica
CVE-2026-46703
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
Crítica
CVE-2026-46695
BoxLite: Permission Bypass Allows Modification of Read-Only Files
Media
CVE-2026-46678
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)
Alta
ghsa-mw8f-w6p8-xrf4
wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None
Crítica
CVE-2026-45568
rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths
Crítica
CVE-2026-7302
SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability
Alta
CVE-2026-2652
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and
Alta
CVE-2026-56398
Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
Media
ghsa-g39v-cvjh-8fpf
Home Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/
Media
CVE-2026-44439
Playwright Capture permits access to local files and internal network resources during page capture
Alta
CVE-2026-42304
Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
Alta
CVE-2026-42266
JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
Media
CVE-2026-86255
wger has an Uncontrolled Resource Consumption issue
Alta
CVE-2026-45134
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
Media
CVE-2026-44223
vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters
Crítica
CVE-2026-31238
Ludwig framework is vulnerable to insecure deserialization in its model serving component
Crítica
CVE-2026-31234
Horovod contains an insecure deserialization vulnerability in its KVStore HTTP server component
Crítica
CVE-2026-31220
PySyft server-side arbitrary Python execution after code approval
Crítica
CVE-2025-65719
Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page
Alta
CVE-2026-43891
changedetection.io has an Arbitrary Local File Read via a crafted backup restore
Alta
CVE-2026-2614
MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.