Crítica
CVE-2026-55615
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 430
Restablecer filtros
Alta
CVE-2026-55786
flyto-core has Unauthenticated Command Execution via HTTP MCP `execute_module`
Alta
CVE-2026-49852
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)
Crítica
CVE-2026-52830
fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection
Crítica
CVE-2026-50027
mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete
Media
CVE-2026-55163
Lemur Privilege Escalation: Non-admin role members can rewrite role membership via PUT /api/1/roles/<id>
Alta
CVE-2026-53925
Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
Media
CVE-2026-48775
LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading
Alta
CVE-2026-46606
Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
Alta
CVE-2026-12530
Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
Alta
CVE-2026-54011
Open WebUI: Stored XSS in Mermaid Markdown Preview
Media
CVE-2026-54019
Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode
Media
CVE-2026-54009
Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field
Alta
CVE-2026-54007
Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
Media
CVE-2026-12491
vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations
Alta
CVE-2026-50574
yt-dlp: Arbitrary code execution via manifest downloads with aria2c
Baja
CVE-2026-53537
python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
Baja
CVE-2026-53538
python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
Alta
CVE-2026-12398
Galaxy NG: command injection vulnerability
Alta
CVE-2026-47781
PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing
Media
CVE-2026-47763
PDM: Project-Local State and Config Writes Follow Symlinks
Baja
CVE-2026-47192
kas's late signature validation may allow unnoticed repository manipulations
Alta
CVE-2026-47418
praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR
Media
CVE-2026-47408
praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.