Conoce las vulnerabilidades. Protege tus aplicaciones.

Media 19.10.2026

ghsa-pcc4-rvhr-2pr8

Extractor de Fortran de Graphify: endurecimiento incompleto de cpp #include permite la lectura/exfiltración arbitraria de archivos del host al indexar un repositorio no confiable

Un endurecimiento incompleto de cpp #include en el extractor de Fortran de Graphify permite leer y exfiltrar archivos locales arbitrarios del host al indexar un repositorio no confiable.

Python (PyPI)

graphifyy

Media 30.09.2026

CVE-2026-103261

Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

Python (PyPI)

tornado

Alta 30.09.2026

CVE-2026-103262

tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM

Python (PyPI)

tornado

Alta 30.09.2026

CVE-2026-103263

Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

Python (PyPI)

tornado

Alta 02.09.2026

CVE-2026-82397

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Python (PyPI)

tornado

Media 01.09.2026

CVE-2026-91990

tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

Python (PyPI)

tornado

Baja 01.09.2026

CVE-2026-91991

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

Python (PyPI)

tornado

Alta 31.07.2026

CVE-2026-53502

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

Python (PyPI)

thumbor

Alta 23.06.2026

CVE-2026-55488

motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read

Python (PyPI)

motioneye

Alta 23.06.2026

CVE-2026-54134

OctoPrint has possible file exfiltration via query parameters on upload endpoints

Python (PyPI)

octoprint

Media 22.06.2026

CVE-2026-31978

motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint

Python (PyPI)

motioneye

Alta 19.06.2026

CVE-2026-54528

jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

Python (PyPI)

jupyterlab-git

Alta 15.06.2026

CVE-2026-49855

tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

Python (PyPI)

tornado

Baja 12.06.2026

CVE-2026-49854

Tornado has out-of-bounds memory access via C extension

Python (PyPI)

tornado

Alta 15.06.2026

CVE-2026-49853

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

Python (PyPI)

tornado

Media 10.06.2025

CVE-2025-48879

OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint

Python (PyPI)

octoprint

Alta 16.05.2025

CVE-2025-47287

Tornado vulnerable to excessive logging caused by malformed multipart form data

Python (PyPI)

tornado

Alta 22.11.2024

CVE-2024-52804

Tornado has an HTTP cookie parsing DoS vulnerability

Python (PyPI)

tornado

Alta 03.04.2024

CVE-2024-30265

Voilà Local file inclusion

Python (PyPI)

voila

Media 06.03.2024

CVE-2024-27287

esphome vulnerable to stored Cross-site Scripting in edit configuration file API

Python (PyPI)

esphome

Crítica 23.06.2026

ghsa-phv5-334h-mxcw

motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal

Python (PyPI)

motioneye

Media 15.06.2026

CVE-2026-91992

Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse

Python (PyPI)

tornado

Crítica 03.06.2026

CVE-2026-44180

Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass

Python (PyPI)

jupyter-enterprise-gateway

Alta 11.03.2026

CVE-2026-35536

Tornado has cookie attribute injection via .RequestHandler.set_cookie

Python (PyPI)

tornado