Media
CVE-2026-73559
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 452
Restablecer filtros
Alta
CVE-2026-68518
Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction
Alta
CVE-2026-62982
Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection
Alta
CVE-2026-55071
MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`
Media
CVE-2026-73416
JupyterLab: PyPI extension blocklist package-name canonicalization bypass
Alta
CVE-2026-52776
compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
Sin evaluar
CVE-2026-74870
openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardw
Alta
CVE-2026-73622
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
Alta
CVE-2026-67422
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
Media
CVE-2026-70484
Open WebUI: Users denied the image-generation permission can still generate images via chat completions
Media
CVE-2026-12261
A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corp
Alta
CVE-2026-12061
Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
Alta
CVE-2026-53505
Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
Alta
CVE-2026-12074
Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
Alta
CVE-2026-12072
Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)
Alta
CVE-2026-55415
datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements
Alta
CVE-2026-54653
`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field
Alta
CVE-2026-54654
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field
Alta
CVE-2026-55390
datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate
Alta
CVE-2026-55391
datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
Alta
CVE-2026-54691
datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects
Alta
CVE-2026-54690
datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)
Alta
CVE-2026-54621
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description
Alta
CVE-2026-55389
datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.