Średnia
CVE-2026-73416
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 448
Wyczyść filtry
Wysoka
CVE-2026-52776
compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
Nieoceniona
CVE-2026-74870
openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardw
Wysoka
CVE-2026-73622
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
Wysoka
CVE-2026-67422
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
Średnia
CVE-2026-70484
Open WebUI: Users denied the image-generation permission can still generate images via chat completions
Średnia
CVE-2026-12261
A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corp
Wysoka
CVE-2026-12061
Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
Wysoka
CVE-2026-53505
Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
Wysoka
CVE-2026-12074
Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
Wysoka
CVE-2026-12072
Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)
Wysoka
CVE-2026-55415
datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements
Wysoka
CVE-2026-54653
`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field
Wysoka
CVE-2026-54654
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field
Wysoka
CVE-2026-55390
datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate
Wysoka
CVE-2026-55391
datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
Wysoka
CVE-2026-54691
datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects
Wysoka
CVE-2026-54690
datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)
Wysoka
CVE-2026-54621
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description
Wysoka
CVE-2026-55389
datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`
Wysoka
CVE-2026-54635
pytonapi has a Webhook Custom Path Authentication Bypass
Wysoka
CVE-2026-59714
Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
Niska
CVE-2026-59226
Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation
Niska
CVE-2026-63632
ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.