Alta
CVE-2026-8596
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 692
Restablecer filtros
Media
CVE-2026-45554
NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes
Alta
CVE-2026-45370
python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection
Media
CVE-2026-46383
Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`
Alta
CVE-2026-45539
Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree
Alta
CVE-2026-45400
Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`
Alta
CVE-2026-45399
Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption
Alta
CVE-2026-45398
Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls
Media
CVE-2026-45318
Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)
Alta
CVE-2026-43978
wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager
Media
CVE-2026-45299
Open WebUI has Stored Cross-Site Scripting In Profile Picture
Baja
CVE-2026-44970
dbt MCP Server Transmits All MCP Tool Arguments Including Raw SQL and --vars Credentials to dbt Labs Telemetry by Default Without Redaction
Media
CVE-2026-43979
local-deep-research is Vulnerable to HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)
Alta
CVE-2026-31248
Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks
Alta
CVE-2026-44340
PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
Media
CVE-2026-44560
Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search
Media
CVE-2026-44557
Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection
Alta
CVE-2026-44556
Open WebUI's responses passthrough endpoint lacks access control authorization
Alta
CVE-2026-44335
PraisonAI has an SSRF bypass
Alta
CVE-2026-44504
Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)
Media
CVE-2026-44226
PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI
Baja
CVE-2026-44220
ciguard: discover_pipeline_files follows symlinks out of scan root
Alta
CVE-2026-33079
Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input
Media
CVE-2026-43901
wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.