Średnia
CVE-2026-73619
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 1 319
Wyczyść filtry
Średnia
CVE-2026-68971
Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team, un
Wysoka
CVE-2026-68968
Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()`
Wysoka
CVE-2026-67422
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
Wysoka
CVE-2026-70492
Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
Średnia
CVE-2026-70488
Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
Wysoka
CVE-2026-70485
Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
Średnia
CVE-2026-54020
Open WebUI: DNS Rebinding SSRF Bypass
Średnia
CVE-2026-70489
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
Średnia
CVE-2026-70487
Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
Niska
CVE-2026-70483
Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint
Średnia
CVE-2026-70480
Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
Wysoka
CVE-2026-70482
Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
Niska
CVE-2026-12482
Keras: tar extraction permits symlink-based path traversal
Średnia
CVE-2026-12261
A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corp
Wysoka
CVE-2026-69249
python-cryptography: Duplicate self-signed intermediates can cause exponential path-building
Wysoka
CVE-2026-12075
Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
Wysoka
CVE-2026-12061
Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
Wysoka
CVE-2026-53502
Thumbor has path traversal via post-validation URL decoding bypass in file_loader
Średnia
CVE-2026-54707
OnionShare Receive mode writes uploaded files even when file uploads are disabled
Średnia
CVE-2026-54706
OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files
Wysoka
CVE-2026-12074
Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
Wysoka
CVE-2026-67424
Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation
Wysoka
CVE-2026-12072
Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.