Alta
CVE-2026-55178
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 1.999
Restablecer filtros
Alta
CVE-2026-91987
atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard
Alta
CVE-2026-91988
atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)
Sin evaluar
CVE-2026-74891
openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known de
Sin evaluar
CVE-2026-74893
openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any cl
Sin evaluar
CVE-2026-74892
openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value ca
Media
CVE-2026-74881
openssl-encrypt has CORS wildcard with allow_credentials=True in standalone servers
Media
CVE-2026-74879
openssl-encrypt's readiness endpoint leaks database error details to unauthenticated callers
Crítica
CVE-2026-74878
openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart
Media
CVE-2026-74880
openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage
Media
CVE-2026-74877
openssl-encrypt has no owner verification on key revocation — any client can revoke any key
Media
CVE-2026-74873
openssl-encrypt has visible password in process list via --password CLI argument
Alta
CVE-2026-91989
atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read
Media
CVE-2026-54249
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
Alta
CVE-2026-73620
GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read
Alta
CVE-2026-73622
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
Media
CVE-2026-59242
Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guar
Media
CVE-2026-68076
Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplie
Alta
CVE-2026-58076
Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, w
Alta
CVE-2026-67422
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
Alta
CVE-2026-70486
Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
Media
CVE-2026-70491
Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
Media
CVE-2026-70493
Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
Alta
CVE-2026-70492
Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.