Media
CVE-2026-57173
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 1.984
Restablecer filtros
Media
CVE-2026-59823
LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
Media
CVE-2026-61589
djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path
Media
CVE-2026-62949
AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION
Alta
CVE-2026-61599
djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
Crítica
CVE-2025-59953
LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy
Media
CVE-2026-61597
djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags
Alta
CVE-2026-61593
djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session
Media
CVE-2026-87014
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
Media
CVE-2026-87015
Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
Media
CVE-2026-87012
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
Crítica
CVE-2026-59971
MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)
Media
CVE-2026-87013
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
Alta
CVE-2026-87011
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
Alta
CVE-2026-87995
Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
Media
CVE-2026-87017
Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
Alta
CVE-2026-87998
Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
Alta
CVE-2026-87996
Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
Alta
CVE-2026-87999
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Media
CVE-2026-50221
OpenStack Swift vulnerable to authenticated server-side request forgery
Alta
CVE-2025-66336
Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path
Media
CVE-2026-9073
foreman-mcp-server Inserts Sensitive Information into Log File
Media
CVE-2026-12773
LiteLLM: MCP Proxy Has Improper Authentication
Baja
CVE-2026-12798
BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.