Media
ghsa-75mw-h36v-2jv7
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 692
Restablecer filtros
Crítica
CVE-2026-48797
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
Media
CVE-2026-44018
Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
Alta
CVE-2026-44017
Docling: Unsafe Zip Extraction in EasyOCR Model Download
Crítica
CVE-2026-56260
Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution
Crítica
ghsa-qxvg-h7q2-hcxh
motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)
Alta
CVE-2026-54317
Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
Crítica
CVE-2026-48519
Langflow: Unauthenticated RCE in Shareable Playgrounds
Media
CVE-2026-48520
Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read
Media
CVE-2026-54276
aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
Alta
CVE-2026-59152
LangSmith SDK TracingMiddleware: Arbitrary server-side file read
Media
CVE-2026-58198
ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer
Alta
CVE-2026-58499
EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id
Crítica
CVE-2026-55447
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
Alta
ghsa-p5wc-9w9r-m232
Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser
Media
CVE-2026-67338
JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol
Crítica
CVE-2026-57125
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
Alta
CVE-2026-57112
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
Baja
ghsa-8rfp-98v4-mmr6
Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output
Alta
CVE-2026-11816
Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filt
Alta
CVE-2026-5497
vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processin
Sin evaluar
pysec-2026-207
durabletask 1.4.1, 1.4.2, and 1.4.3 contain malicious code distributed via a compromised maintainer account
Crítica
CVE-2026-45758
Malicious code in guardrails-ai 0.10.1 (supply chain compromise)
Baja
CVE-2026-45426
Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against D
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.