Media
CVE-2026-40491
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 6.861
Restablecer filtros
Alta
CVE-2026-41496
PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)
Crítica
CVE-2026-41497
PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection
Crítica
CVE-2026-27197
Sentry: Improper authentication on SAML SSO process allows user identity linking
Alta
CVE-2026-31987
Apache Airflow: JWT token appearing in logs
Alta
CVE-2025-54550
Apache Airflow: RCE by race condition in example_xcom dag
Media
CVE-2026-41182
LangSmith SDK: Streaming token events bypass output redaction
Alta
CVE-2026-40192
FITS GZIP decompression bomb in Pillow
Media
CVE-2026-40256
Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision
Media
CVE-2026-39845
Weblate: SSRF via the webhook add-on using unprotected fetch_url()
Alta
CVE-2026-34393
Weblate: Privilege escalation in the user API endpoint
Alta
CVE-2026-34242
Weblate: Arbitrary File Read via Symlink
Media
CVE-2026-34244
Weblate: SSRF via Project-Level Machinery Configuration
Media
CVE-2026-33440
Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads
Alta
CVE-2026-33435
Weblate: Remote code execution during backup restoration
Media
CVE-2026-33220
Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
Crítica
CVE-2026-30625
Upsonic: remote code execution vulnerability in its MCP server/task creation functionality
Media
CVE-2026-33214
Weblate: Improper access control for the translation memory in API
Baja
CVE-2026-33212
Weblate: Improper access control for pending tasks in API
Media
CVE-2026-25219
Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access
Baja
ghsa-fj52-5g4h-gmq8
pyLoad's Session Not Invalidated After Permission Changes
Baja
CVE-2026-7808
Multiple security fixes in justhtml
Crítica
CVE-2026-40576
excel-mcp-server has a Path Traversal issue
Alta
CVE-2026-33858
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly tru
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.