Media
CVE-2026-38743
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 4.358
Restablecer filtros
Crítica
CVE-2025-62373
Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer
Alta
CVE-2026-41241
pretalx vulnerable to stored cross-site scripting in organizer search typeahead
Crítica
CVE-2026-3960
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient secu
Media
CVE-2026-6827
justhtml has sanitization bypass in custom policies and programmatic DOM
Media
CVE-2026-40594
pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)
Media
CVE-2026-39377
nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames
Media
CVE-2026-35588
Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values
Alta
CVE-2026-35587
Glances has SSRF in IP Plugin via public_api leading to credential leakage
Alta
CVE-2026-34839
Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS
Media
CVE-2026-28684
python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback
Baja
CVE-2026-32690
Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries
Alta
CVE-2026-25917
Apache Airflow allows code execution through crafted XCom payloads
Media
CVE-2026-30912
Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false
Alta
CVE-2026-32228
Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions
Media
CVE-2026-40491
gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall
Alta
CVE-2026-41496
PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)
Crítica
CVE-2026-41497
PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection
Crítica
CVE-2026-27197
Sentry: Improper authentication on SAML SSO process allows user identity linking
Alta
CVE-2026-31987
Apache Airflow: JWT token appearing in logs
Alta
CVE-2025-54550
Apache Airflow: RCE by race condition in example_xcom dag
Media
CVE-2026-41182
LangSmith SDK: Streaming token events bypass output redaction
Media
CVE-2026-40256
Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision
Media
CVE-2026-34244
Weblate: SSRF via Project-Level Machinery Configuration
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.