Media
CVE-2026-2734
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 6.861
Restablecer filtros
Alta
ghsa-mw8f-w6p8-xrf4
wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None
Media
CVE-2026-42526
In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_t
Crítica
CVE-2026-31072
APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization
Crítica
CVE-2026-45568
rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths
Crítica
ghsa-wx9m-wx4f-4cmg
Malicious dropper in mistralai 2.4.6 PyPI package
Alta
ghsa-j5rm-v3vh-vx94
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
Alta
ghsa-qq2p-4282-cfc5
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
Media
ghsa-74r7-3mjm-jc5v
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
Alta
ghsa-qw48-84f6-28gv
Graphite Has a Pickle Deserialization Vulnerability
Crítica
CVE-2026-7301
SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket
Crítica
CVE-2026-7302
SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability
Crítica
CVE-2026-7304
SGLang: Unauthenticated RCE via --enable-custom-logit-processor
Alta
CVE-2026-2652
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and
Crítica
CVE-2026-45369
utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol
Alta
CVE-2026-56398
Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
Media
ghsa-g39v-cvjh-8fpf
Home Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/
Alta
CVE-2026-44513
Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components
Media
CVE-2026-44439
Playwright Capture permits access to local files and internal network resources during page capture
Alta
CVE-2026-42304
Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
Alta
CVE-2026-44432
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
Alta
CVE-2026-44431
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
Alta
CVE-2026-42266
JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
Media
CVE-2026-86255
wger has an Uncontrolled Resource Consumption issue
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.