Mittel
CVE-2026-2734
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 6.861
Filter zurücksetzen
Hoch
ghsa-mw8f-w6p8-xrf4
wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None
Mittel
CVE-2026-42526
In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_t
Kritisch
CVE-2026-31072
APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization
Kritisch
CVE-2026-45568
rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths
Kritisch
ghsa-wx9m-wx4f-4cmg
Malicious dropper in mistralai 2.4.6 PyPI package
Hoch
ghsa-j5rm-v3vh-vx94
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
Hoch
ghsa-qq2p-4282-cfc5
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
Mittel
ghsa-74r7-3mjm-jc5v
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
Hoch
ghsa-qw48-84f6-28gv
Graphite Has a Pickle Deserialization Vulnerability
Kritisch
CVE-2026-7301
SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket
Kritisch
CVE-2026-7302
SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability
Kritisch
CVE-2026-7304
SGLang: Unauthenticated RCE via --enable-custom-logit-processor
Hoch
CVE-2026-2652
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and
Kritisch
CVE-2026-45369
utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol
Hoch
CVE-2026-56398
Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
Mittel
ghsa-g39v-cvjh-8fpf
Home Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/
Hoch
CVE-2026-44513
Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components
Mittel
CVE-2026-44439
Playwright Capture permits access to local files and internal network resources during page capture
Hoch
CVE-2026-42304
Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
Hoch
CVE-2026-44432
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
Hoch
CVE-2026-44431
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
Hoch
CVE-2026-42266
JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
Mittel
CVE-2026-86255
wger has an Uncontrolled Resource Consumption issue
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.