Baja
CVE-2026-107727
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 307
Restablecer filtros
Alta
CVE-2026-46434
wger: Trainer Privilege Escalation - Improper Privilege Management
Media
CVE-2026-46437
wger: API credentials remain valid after logout/password change
Media
CVE-2026-45161
wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
Alta
CVE-2026-43976
wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
Media
CVE-2026-57179
social-auth-core has a Session Fixation issue
Media
CVE-2026-83801
Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text
Media
CVE-2026-61589
djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path
Crítica
CVE-2026-61594
djust has an authorization bypass on the WebSocket/SSE mount path
Media
CVE-2026-61588
djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client
Alta
ghsa-62mm-xwmv-crhg
khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem
Alta
ghsa-xjw9-38cr-6372
djust: A template binding inherits a context safety grant it never earned (XSS)
Alta
ghsa-9395-2g46-rj3f
djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)
Media
CVE-2026-73228
Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`
Media
CVE-2026-73229
Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests
Media
CVE-2026-54625
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
Alta
CVE-2026-54623
django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
Media
CVE-2026-54622
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
Media
CVE-2026-61663
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
Media
CVE-2026-54624
django CMS: Structure endpoint bypasses page-view permission
Media
CVE-2026-63003
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
Media
CVE-2026-75526
django CMS: Stored XSS in edit-mode plugin exception rendering
Media
CVE-2026-81724
NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input
Alta
CVE-2026-54284
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.