Alta
CVE-2026-9769
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 6.801
Restablecer filtros
Alta
CVE-2026-45831
ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to
Alta
CVE-2026-45830
ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection
Crítica
CVE-2026-45833
ChromaDB has a code injection vulnerability
Media
CVE-2026-54421
OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties
Media
CVE-2026-87818
GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle
Alta
CVE-2026-87819
GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing
Alta
CVE-2026-87817
GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution
Alta
CVE-2026-84381
HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies
Media
CVE-2026-73262
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
Media
CVE-2026-12259
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. T
Alta
pysec-2026-4010
Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit
Crítica
pysec-2026-4009
Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator
Crítica
CVE-2024-33663
python-jose algorithm confusion guard bypassed by DER-encoded public keys
Media
CVE-2026-32773
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege esca
Media
CVE-2026-91990
tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
Baja
CVE-2026-91991
Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`
Alta
ghsa-gqvg-gmmx-x4hm
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
Media
ghsa-73p9-6hrp-8qhr
AIIR verification and policy gates could report success without enforcing the control (fail-open)
Media
CVE-2026-81725
NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks
Media
CVE-2026-81727
NLTK: Downloader.download follows hardlinks and overwrites outside-root files
Media
CVE-2026-81724
NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input
Alta
CVE-2026-81726
NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots
Sin evaluar
CVE-2026-81720
openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers w
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.