Średnia
CVE-2026-48776
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 1 999
Wyczyść filtry
Średnia
ghsa-gj48-438w-jh9v
Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes
Średnia
ghsa-g75f-g53v-794x
Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning
Średnia
CVE-2026-91992
Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse
Krytyczna
CVE-2026-44172
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sen
Wysoka
CVE-2026-5497
vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processin
Wysoka
CVE-2026-10143
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by suppl
Krytyczna
CVE-2026-45758
Malicious code in guardrails-ai 0.10.1 (supply chain compromise)
Krytyczna
CVE-2026-47731
NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)
Średnia
CVE-2026-47707
Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
Średnia
CVE-2026-47706
Strawberry GraphQL has a Circular Fragment Reference DOS
Niska
CVE-2026-45739
Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs
Krytyczna
CVE-2026-44182
Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering
Krytyczna
CVE-2026-44181
Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution
Krytyczna
CVE-2026-44180
Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass
Wysoka
CVE-2026-44545
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote at
Wysoka
CVE-2026-5241
huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path
Wysoka
CVE-2026-4035
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environme
Średnia
CVE-2026-3198
MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions
Średnia
CVE-2026-49267
Apache Airflow has no certificate validation on SMTP STARTTLS connections
Średnia
CVE-2026-48726
A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for `FabAuthManager` and `KeycloakAuthManager` d
Niska
CVE-2026-45426
Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against D
Wysoka
CVE-2026-42359
A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names (e
Średnia
CVE-2026-41017
Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (e.g. nginx / Envoy /
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.