Alta
CVE-2026-55540
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 6.825
Restablecer filtros
Alta
CVE-2026-55534
PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution
Alta
CVE-2026-55538
PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated
Media
CVE-2026-55531
PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)
Media
CVE-2026-55530
praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool
Alta
CVE-2026-55537
PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114
Alta
CVE-2026-55541
PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
Media
CVE-2026-55535
PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation
Crítica
CVE-2026-53710
mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
Media
CVE-2026-55529
PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server
Alta
CVE-2026-55523
praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets
Alta
CVE-2026-71513
NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution
Alta
CVE-2026-55525
praisonaiagents web_crawl vulnerable to SSRF via redirect-following
Alta
CVE-2026-68508
Hydra: hydra.utils.instantiate with untrusted config can lead to code execution
Media
CVE-2026-54625
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
Alta
CVE-2026-54623
django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
Crítica
CVE-2026-61539
Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing
Media
CVE-2026-55468
Wagtail: Improper restriction handling on Pages admin API
Alta
CVE-2026-72818
NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking
Media
CVE-2026-54622
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
Media
CVE-2026-61663
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
Media
CVE-2026-55244
asteval has a Sandbox Escape via BaseException Subclasses
Media
CVE-2026-54624
django CMS: Structure endpoint bypasses page-view permission
Media
CVE-2026-63003
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.