Crítica
CVE-2026-59971
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 58
Restablecer filtros
Alta
ghsa-62mm-xwmv-crhg
khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem
Media
CVE-2026-54553
Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
Alta
CVE-2026-55533
PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret
Alta
CVE-2026-55528
praisonaiagents: AgentServer declares auth_token but never enforces it on any route
Alta
CVE-2026-55541
PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
Media
CVE-2026-55529
PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server
Media
CVE-2026-68517
Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard
Crítica
CVE-2026-61736
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
Alta
CVE-2026-59950
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
Crítica
CVE-2026-57124
PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai
Alta
CVE-2026-57146
PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
Crítica
CVE-2026-57123
PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
Crítica
CVE-2026-57127
praisonai: recipe serve auth middleware silently disables itself when no secret is set
Crítica
CVE-2026-57131
PraisonAI: Jobs API exposes agent-execution endpoints with no authentication
Alta
CVE-2026-56836
PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
Media
CVE-2026-55837
dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
Alta
CVE-2026-46608
Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
Baja
CVE-2026-53537
python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
Baja
CVE-2026-53540
python-multipart: Negative Content-Length in parse_form buffers the entire body in memory
Alta
CVE-2026-53539
python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
Baja
CVE-2026-53538
python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
Media
CVE-2026-45554
NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes
Alta
CVE-2026-44716
Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.