Wysoka
CVE-2026-73417
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 2 003
Wyczyść filtry
Krytyczna
CVE-2026-61459
mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials
Wysoka
CVE-2026-52776
compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
Wysoka
CVE-2026-73498
mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment
Wysoka
CVE-2026-55178
GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
Wysoka
CVE-2026-91987
atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard
Wysoka
CVE-2026-91988
atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)
Nieoceniona
CVE-2026-74891
openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known de
Nieoceniona
CVE-2026-74893
openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any cl
Nieoceniona
CVE-2026-74892
openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value ca
Średnia
CVE-2026-74881
openssl-encrypt has CORS wildcard with allow_credentials=True in standalone servers
Średnia
CVE-2026-74879
openssl-encrypt's readiness endpoint leaks database error details to unauthenticated callers
Krytyczna
CVE-2026-74878
openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart
Średnia
CVE-2026-74880
openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage
Średnia
CVE-2026-74877
openssl-encrypt has no owner verification on key revocation — any client can revoke any key
Średnia
CVE-2026-74873
openssl-encrypt has visible password in process list via --password CLI argument
Wysoka
CVE-2026-91989
atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read
Średnia
CVE-2026-54249
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
Wysoka
CVE-2026-73620
GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read
Wysoka
CVE-2026-73622
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
Średnia
CVE-2026-59242
Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guar
Średnia
CVE-2026-68076
Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplie
Wysoka
CVE-2026-58076
Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, w
Wysoka
CVE-2026-67422
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.