Media
CVE-2026-54020
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 1.336
Restablecer filtros
Media
CVE-2026-70489
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
Media
CVE-2026-70487
Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
Baja
CVE-2026-70483
Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint
Media
CVE-2026-70480
Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
Alta
CVE-2026-70482
Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
Baja
CVE-2026-12482
Keras: tar extraction permits symlink-based path traversal
Media
CVE-2026-12261
A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corp
Alta
CVE-2026-69249
python-cryptography: Duplicate self-signed intermediates can cause exponential path-building
Alta
CVE-2026-12075
Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
Alta
CVE-2026-12061
Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
Alta
CVE-2026-53502
Thumbor has path traversal via post-validation URL decoding bypass in file_loader
Media
CVE-2026-54707
OnionShare Receive mode writes uploaded files even when file uploads are disabled
Media
CVE-2026-54706
OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files
Alta
CVE-2026-12074
Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
Alta
CVE-2026-67424
Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation
Alta
CVE-2026-12072
Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)
Crítica
CVE-2026-67429
Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)
Alta
CVE-2026-54727
proot-distro has a Container Isolation Bypass via Crafted Restore Archive
Alta
CVE-2026-54574
`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive
Media
CVE-2026-67435
linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect
Alta
CVE-2026-67425
Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url
Alta
CVE-2026-67427
Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted
Crítica
CVE-2026-67426
Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.