Hoch
CVE-2026-77274
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 422
Filter zurücksetzen
Hoch
CVE-2026-77260
MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)
Hoch
CVE-2026-77262
MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)
Mittel
CVE-2026-77272
MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler
Mittel
CVE-2026-86000
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns
Mittel
CVE-2026-85999
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)
Mittel
CVE-2026-85078
sanic chunked trailer request smuggling allows hidden second request execution
Kritisch
CVE-2026-61594
djust has an authorization bypass on the WebSocket/SSE mount path
Mittel
CVE-2026-61597
djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags
Hoch
CVE-2025-66336
Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path
Niedrig
CVE-2026-12797
BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints
Hoch
CVE-2026-102925
virtualenv bash and fish activation scripts execute commands embedded in paths
Mittel
CVE-2026-102938
virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
Hoch
CVE-2026-103262
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
Mittel
CVE-2026-81930
Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}.sno
Mittel
CVE-2026-81914
Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that del
Hoch
CVE-2026-100844
MONAI vulnerable to OS command injection
Kritisch
CVE-2026-61732
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Mittel
CVE-2026-84380
HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
Mittel
CVE-2026-84379
HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
Mittel
CVE-2026-73555
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
Hoch
CVE-2026-76098
Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
Hoch
CVE-2026-62676
Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
Mittel
CVE-2026-71492
Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.