Wysoka
CVE-2026-55071
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 4 309
Wyczyść filtry
Wysoka
CVE-2026-55074
Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)
Średnia
CVE-2026-73416
JupyterLab: PyPI extension blocklist package-name canonicalization bypass
Wysoka
CVE-2026-73415
JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
Wysoka
CVE-2026-73417
JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
Wysoka
CVE-2026-73568
libp2p: yamux connection DoS via oversized data frame
Średnia
CVE-2026-9318
tablib: Stored XSS in the HTML export via unescaped dataset title
Krytyczna
CVE-2026-64825
Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding
Krytyczna
CVE-2026-61459
mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials
Wysoka
CVE-2026-52776
compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
Wysoka
CVE-2026-73498
mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment
Niska
CVE-2026-10775
SGLang is Vulnerable to DoS via the data_hash Function
Wysoka
CVE-2026-55178
GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
Wysoka
CVE-2026-91987
atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard
Wysoka
CVE-2026-91988
atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)
Nieoceniona
CVE-2026-74900
openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from o
Nieoceniona
CVE-2026-74901
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify
Nieoceniona
CVE-2026-74891
openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known de
Nieoceniona
CVE-2026-74893
openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any cl
Nieoceniona
CVE-2026-74894
openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload ar
Nieoceniona
CVE-2026-74895
openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to
Nieoceniona
CVE-2026-74896
openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use _
Nieoceniona
CVE-2026-74892
openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value ca
Nieoceniona
CVE-2026-74899
openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.