Media
CVE-2026-85709
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 682
Restablecer filtros
Crítica
CVE-2026-77244
[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token
Alta
CVE-2026-77267
mcp-atlassian has an incomplete SSRF remediation
Media
CVE-2026-77249
MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup
Alta
CVE-2026-77243
MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
Alta
CVE-2026-77246
MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path
Media
CVE-2026-86000
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns
Media
CVE-2026-85999
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)
Media
CVE-2026-61589
djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path
Crítica
CVE-2025-59953
LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy
Media
CVE-2026-87013
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
Crítica
CVE-2026-68770
sentence-transformers local model loading bypasses trust_remote_code and executes custom Python
Alta
CVE-2026-87996
Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
Alta
CVE-2026-102831
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
Sin evaluar
CVE-2026-100841
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MON
Crítica
CVE-2026-61732
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Media
CVE-2026-77528
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
Alta
ghsa-39wr-7q6h-cf68
LMDeploy has an SSRF bypass
Alta
ghsa-xjw9-38cr-6372
djust: A template binding inherits a context safety grant it never earned (XSS)
Alta
ghsa-9395-2g46-rj3f
djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)
Media
CVE-2026-73555
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
Media
CVE-2026-73557
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
Media
CVE-2026-84305
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
Media
CVE-2026-84311
pypdf: Possible long runtimes/large memory usage when extracting XForm objects
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.