Alta
ghsa-69qj-pvh9-c5wg
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 4.359
Restablecer filtros
Media
ghsa-gj48-438w-jh9v
Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes
Media
ghsa-g75f-g53v-794x
Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning
Baja
ghsa-8rfp-98v4-mmr6
Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output
Media
CVE-2026-91992
Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse
Alta
ghsa-537c-gmf6-5ccf
Vulnerable OpenSSL included in cryptography wheels
Alta
CVE-2026-11816
Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filt
Alta
CVE-2026-5497
vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processin
Alta
CVE-2026-10142
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by
Alta
CVE-2026-10143
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by suppl
Alta
CVE-2026-46373
SQLFluff: Recursive Stack Overflow in Parser
Alta
CVE-2026-46374
SQLFluff: Uncontrolled Resource Consumption in SQLFluff Parser
Sin evaluar
pysec-2026-207
durabletask 1.4.1, 1.4.2, and 1.4.3 contain malicious code distributed via a compromised maintainer account
Media
CVE-2026-49818
The Apache Airflow Samba provider's `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path o
Media
CVE-2026-45409
Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix
Crítica
CVE-2026-45758
Malicious code in guardrails-ai 0.10.1 (supply chain compromise)
Crítica
CVE-2026-47731
NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)
Media
CVE-2026-50589
OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash
Crítica
CVE-2026-47708
MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper
Media
CVE-2026-47707
Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
Media
CVE-2026-47706
Strawberry GraphQL has a Circular Fragment Reference DOS
Baja
CVE-2026-45739
Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs
Media
CVE-2026-10804
A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation le
Crítica
CVE-2026-44182
Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.