Sin evaluar
CVE-2026-100841
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 692
Restablecer filtros
Crítica
CVE-2026-61732
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Media
CVE-2026-77528
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
Alta
ghsa-39wr-7q6h-cf68
LMDeploy has an SSRF bypass
Alta
ghsa-xjw9-38cr-6372
djust: A template binding inherits a context safety grant it never earned (XSS)
Alta
ghsa-9395-2g46-rj3f
djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)
Media
CVE-2026-73555
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
Media
CVE-2026-73557
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
Media
CVE-2026-84305
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
Media
CVE-2026-84311
pypdf: Possible long runtimes/large memory usage when extracting XForm objects
Media
CVE-2026-81723
NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`
Alta
CVE-2026-55509
WsgiDAV MySQL provider has a blind SQL injection
Alta
CVE-2026-55520
Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching
Alta
CVE-2026-54757
Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
Media
CVE-2026-55618
eml_parser has a URL extraction bypass via HTML entities in URLs
Alta
CVE-2026-55539
PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete
Alta
CVE-2026-55526
praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
Alta
CVE-2026-55538
PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated
Crítica
CVE-2026-61539
Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing
Alta
CVE-2026-72818
NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking
Media
CVE-2026-75526
django CMS: Stored XSS in edit-mode plugin exception rendering
Crítica
CVE-2026-58473
Cognee allows non-superusers to overwrite global LLM configuration
Media
CVE-2026-87818
GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle
Alta
CVE-2026-87819
GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.