Alta
CVE-2026-61442
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 1.984
Restablecer filtros
Alta
CVE-2026-61427
PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface
Media
CVE-2026-61440
PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization
Alta
CVE-2026-60091
PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
Alta
CVE-2026-61433
PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
Alta
CVE-2026-61435
PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
Alta
CVE-2026-107377
datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory
Media
CVE-2026-60088
PraisonAI: Project custom command templates can read outside-workspace files into model prompts
Media
CVE-2026-60090
PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL
Media
CVE-2026-107292
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
Alta
CVE-2026-107295
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
Media
CVE-2026-107290
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
Alta
CVE-2026-61430
PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure
Media
CVE-2026-60089
PraisonAI: Project config can auto-save agent output outside the project root
Crítica
CVE-2026-105697
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
Media
CVE-2026-105698
Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
Alta
CVE-2026-105699
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
Alta
CVE-2026-106439
Hydra: Mutable instantiate policy sets allow target blocklist bypass
Alta
CVE-2026-106443
WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE
Alta
CVE-2026-106441
Hydra logging configuration permits unsafe callable resolution
Alta
CVE-2026-106442
Hydra instantiate target blacklist bypasses permit code execution
Media
CVE-2026-106454
Twisted: IMAP wildcardToRegexp() ReDoS
Alta
CVE-2026-105741
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
Crítica
CVE-2026-61444
PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.