Media
CVE-2026-70667
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 1.319
Restablecer filtros
Media
CVE-2026-73974
linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)
Alta
CVE-2026-70666
Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
Crítica
Explotada en ataques
CVE-2026-64849
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
Media
CVE-2026-68922
MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads
Crítica
CVE-2026-55209
resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read
Alta
CVE-2026-59893
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
Media
CVE-2026-68923
MobSF's CSRF checks not enforced after Django migration
Media
CVE-2026-68520
Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
Media
CVE-2026-73559
vLLM: Completion prompt lists fan out into unbounded engine requests
Alta
CVE-2026-68518
Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction
Media
CVE-2026-68517
Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard
Alta
CVE-2026-55071
MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`
Alta
CVE-2026-73417
JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
Alta
CVE-2026-73568
libp2p: yamux connection DoS via oversized data frame
Alta
CVE-2026-52776
compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
Alta
CVE-2026-73498
mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment
Alta
CVE-2026-55178
GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
Sin evaluar
CVE-2026-74889
openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key
Crítica
CVE-2026-74878
openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart
Alta
CVE-2026-73624
GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
Media
CVE-2026-73621
GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count
Alta
CVE-2026-73620
GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read
Alta
CVE-2026-73622
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.