Media
CVE-2026-54503
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 738
Restablecer filtros
Alta
CVE-2026-52870
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
Alta
CVE-2026-54447
garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store
Crítica
CVE-2026-57147
praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery
Alta
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
Crítica
CVE-2026-57496
netlicensing-mcp: REST Path Traversal Bypasses Token Redaction
Crítica
CVE-2026-57148
praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)
Alta
CVE-2026-57130
PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
Alta
CVE-2026-57122
PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)
Crítica
CVE-2026-57124
PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai
Media
CVE-2026-57120
PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder
Alta
CVE-2026-57114
PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
Crítica
CVE-2026-57131
PraisonAI: Jobs API exposes agent-execution endpoints with no authentication
Alta
CVE-2026-57117
PraisonAI: Compute-bridged file tools allow shell command injection
Alta
CVE-2026-56835
PraisonAI Slack app_mention bypasses configured user/channel authorization
Alta
CVE-2026-56837
PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing
Alta
CVE-2026-56840
PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools
Media
ghsa-mfr4-mq8w-vmg6
PRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs
Media
ghsa-8rqh-vxpr-x77p
plone.restapi: Stored XSS by spoofing mime type
Alta
CVE-2026-105315
django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result Deserialization
Alta
CVE-2026-59885
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
Media
CVE-2026-49836
psd-tools vulnerable to arbitrary file write via smart-object filename
Alta
CVE-2026-49851
Mistune: Potential DoS via quadratic-time parsing in parse_link_text
Alta
CVE-2026-54071
BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.