Media
CVE-2025-14691
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 6.855
Restablecer filtros
Alta
CVE-2025-67726
Tornado: Quadratic DoS via Crafted Multipart Parameters
Media
CVE-2025-67724
Tornado vulnerable to Header Injection and XSS via reason argument
Alta
CVE-2025-67725
Tornado: Quadratic DoS via Repeated Header Coalescing
Crítica
CVE-2025-13780
pgadmin4 has a Meta-Command Filter Command Execution
Crítica
CVE-2025-67511
Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool
Crítica
CVE-2025-65548
NUT-14 allows cashu tokens to be created with a preimage hash. However, nutshell (cashubtc/nuts) before 0.18.0 do not validate the size of preimage when the token is spent. The preimage is stored by t
Alta
Explotada en ataques
CVE-2025-34291
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with all
Baja
CVE-2025-63681
open-webui is Vulnerable to Incorrect Access Control
Media
CVE-2025-64460
Django is vulnerable to DoS via XML serializer text extraction
Media
CVE-2025-13372
Django is vulnerable to SQL injection in column aliases
Media
CVE-2025-13742
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final em
Baja
CVE-2025-65681
An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-contr
Baja
ghsa-j4gv-6x9v-v23g
OMERO.web uses jquery-form library, which may be vulnerable to XSS attack
Alta
CVE-2025-13609
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent'
Media
CVE-2025-62609
MLX has Wild Pointer Dereference in load_gguf()
Media
CVE-2025-62608
MLX has heap-buffer-overflow in load()
Media
CVE-2025-64521
authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account
Alta
CVE-2025-60455
Modular Max Serve has Unsafe Deserialization vulnerability
Alta
CVE-2025-64076
Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to Out-of-Bound
Crítica
CVE-2025-55449
AstrBot is vulnerable to RCE with hard-coded JWT signing keys
Crítica
CVE-2025-12762
pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode
Media
CVE-2025-64429
DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The Duc
Baja
CVE-2025-63396
An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop() can cause torch.profiler.profile (PythonTracer) to crash or hang during finalization, leading to a Denial of Service (Do
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.