Conoce las vulnerabilidades. Protege tus aplicaciones.

Alta 20.10.2026

CVE-2026-112400

Pillow: la búsqueda en GIF mantiene el tamaño rechazado tras DecompressionBombError, permitiendo DoS

Un fallo en Pillow permite que un archivo GIF manipulado provoque una asignación excesiva de memoria cuando una aplicación captura errores de descompresión al avanzar fotogramas y reutiliza el objeto de imagen. Esto puede provocar el agotamiento de la memoria y una denegación de servicio.

Python (PyPI)

pillow

Baja 14.10.2026

CVE-2026-59180

Apprise reenvía cabeceras de autenticación configuradas a través de redirecciones HTTP de origen cruzado

Los complementos y cargadores HTTP de Apprise siguen redirecciones por defecto y reenvían las cabeceras de autenticación configuradas. Si un destino se ve comprometido o sufre un ataque de intermediario, los secretos pueden filtrarse a un host de origen cruzado arbitrario.

Python (PyPI)

apprise

Alta 09.10.2026

ghsa-889w-m37p-88m5

pyLoad: Api.set_user_permission never invalidates the target's session

Python (PyPI)

pyload-ng

Alta 09.10.2026

ghsa-fr26-jjhm-638c

pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

Python (PyPI)

pyload-ng

Baja 09.10.2026

CVE-2026-107727

Strawberry legacy graphql-ws retains naturally completed subscription slots

Python (PyPI)

strawberry-graphql

Alta 08.10.2026

CVE-2026-61442

PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

Python (PyPI)

praisonai-platform

Alta 08.10.2026

CVE-2026-61427

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

Python (PyPI)

praisonai

Media 08.10.2026

CVE-2026-61440

PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization

Python (PyPI)

praisonai-platform

Alta 08.10.2026

CVE-2026-61435

PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

Python (PyPI)

praisonai

Media 08.10.2026

CVE-2026-61431

PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace

Python (PyPI)

praisonai

Media 08.10.2026

CVE-2026-60088

PraisonAI: Project custom command templates can read outside-workspace files into model prompts

Python (PyPI)

praisonai

Media 08.10.2026

CVE-2026-61432

PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

Python (PyPI)

praisonaiagents

Alta 08.10.2026

CVE-2026-61430

PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure

Python (PyPI)

praisonaiagents

Media 08.10.2026

CVE-2026-60089

PraisonAI: Project config can auto-save agent output outside the project root

Python (PyPI)

praisonaiagents

Alta 07.10.2026

CVE-2026-61439

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

Python (PyPI)

praisonai

Media 07.10.2026

CVE-2026-61441

PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

Python (PyPI)

praisonai-platform

Alta 07.10.2026

CVE-2026-61436

PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

Python (PyPI)

praisonai

Media 05.10.2026

CVE-2026-105758

vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

Python (PyPI)

vllm

Media 05.10.2026

CVE-2026-105760

vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

Python (PyPI)

vllm

Media 05.10.2026

CVE-2026-104874

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Python (PyPI)

multidict

Media 05.10.2026

CVE-2026-105753

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

Python (PyPI)

vllm

Media 30.09.2026

CVE-2026-103001

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

Python (PyPI)

pyjwt

Media 30.09.2026

CVE-2026-101918

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

Python (PyPI)

pyjwt

Media 29.09.2026

CVE-2026-102269

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

Python (PyPI)

pyjwt