Alta
CVE-2026-46606
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.405
Media
CVE-2026-55837
dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
Alta
CVE-2026-46608
Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
Media
CVE-2026-55865
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
Alta
CVE-2026-54499
Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders
Baja
CVE-2026-54711
PGHoard: Password written to debug log
Alta
CVE-2026-23879
py7zr: Arbitrary File Write Vulnerability
Alta
CVE-2026-54528
jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
Alta
CVE-2026-12530
Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
Alta
CVE-2026-54695
Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID
Alta
CVE-2025-26240
pdfkit: Path traversal in from_string
Media
CVE-2026-54386
marimo contains a reflected cross-site scripting vulnerability in the notebook page
Media
CVE-2026-55748
OpenStack Horizon RC file generation does not escape special characters in project names
Alta
CVE-2026-53869
Hermes Agent contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation
Media
CVE-2026-53870
Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)
Baja
CVE-2026-12567
BBOT: Symlink-Following Arbitrary Write via github_workflows Module
Media
CVE-2026-12568
BBOT: Arbitrary File Write in postman_download Module
Media
CVE-2026-12565
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
Baja
CVE-2026-12566
BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing
Alta
CVE-2026-54008
Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
Alta
CVE-2026-54010
Open WebUI: Forged chat-file link allows cross-user file read and deletion
Alta
CVE-2026-54012
Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
Alta
CVE-2026-54011
Open WebUI: Stored XSS in Mermaid Markdown Preview
Alta
CVE-2026-54013
Open WebUI: Stored XSS to Account Takeover via Model Profile Images
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.