Alta
CVE-2023-36809
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 116
Restablecer filtros
Media
CVE-2023-32686
kiwitcms vulnerable to stored XSS via unrestricted files upload
Alta
CVE-2023-33977
kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload
Alta
CVE-2023-30613
Unrestricted file upload in kiwi TCMS
Alta
CVE-2026-8147
MLflow: trace API endpoints lack proper authorization validators
Crítica
CVE-2026-53753
Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
Crítica
CVE-2026-31233
Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism
Crítica
CVE-2025-68664
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
Crítica
CVE-2026-56260
Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution
Crítica
CVE-2026-47708
MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper
Media
CVE-2026-47706
Strawberry GraphQL has a Circular Fragment Reference DOS
Alta
CVE-2026-42359
A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names (e
Alta
CVE-2026-44345
BentoML Dockerfile command injection via docker.base_image (sister of pending GHSA-w2pm-x38x-jp44 / CVE-2026-33744 / CVE-2026-35043)
Alta
CVE-2026-44346
Dockerfile command injection via envs[*].name in bentofile.yaml (sibling fix-bypass of CVE-2026-33744 and CVE-2026-35043)
Media
CVE-2026-2734
MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks
Alta
CVE-2026-2652
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and
Alta
CVE-2026-56398
Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
Crítica
CVE-2026-44336
PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection
Alta
CVE-2026-42215
GitPython has Command Injection via Git options bypass
Media
CVE-2026-41654
Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
Crítica
Explotada en ataques
CVE-2026-39987
Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
Media
CVE-2026-34446
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
Baja
CVE-2026-34203
Nautobot: Management of users via REST API does not apply configured password validators
Alta
CVE-2026-33981
Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.