Alta
CVE-2026-35397
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 2.003
Restablecer filtros
Crítica
CVE-2026-42048
Langflow Knowledge Bases API is Vulnerable to Path Traversal
Crítica
CVE-2026-42864
FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft
Baja
CVE-2026-6907
Django Uses Cache Containing Sensitive Information
Media
CVE-2026-5766
Django has an Improper Handling of Length Parameter Inconsistency
Media
CVE-2025-61669
Jupyter Server has an open redirection vulnerability in `next` query parameter
Media
ghsa-8pqq-224h-x875
ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key
Media
CVE-2026-42086
OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender
Media
CVE-2026-41016
apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider
Media
CVE-2026-41481
LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass
Crítica
CVE-2025-62373
Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer
Alta
CVE-2026-41205
Mako: Path traversal via double-slash URI prefix in TemplateLookup
Crítica
CVE-2026-3960
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient secu
Media
CVE-2026-6827
justhtml has sanitization bypass in custom policies and programmatic DOM
Media
CVE-2026-40606
mitmproxy has an LDAP Injection
Media
CVE-2026-40594
pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)
Alta
CVE-2026-35587
Glances has SSRF in IP Plugin via public_api leading to credential leakage
Alta
CVE-2026-34839
Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS
Alta
CVE-2026-25917
Apache Airflow allows code execution through crafted XCom payloads
Crítica
CVE-2026-41497
PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection
Media
CVE-2026-34244
Weblate: SSRF via Project-Level Machinery Configuration
Crítica
CVE-2026-30625
Upsonic: remote code execution vulnerability in its MCP server/task creation functionality
Media
CVE-2026-33214
Weblate: Improper access control for the translation memory in API
Baja
CVE-2026-7808
Multiple security fixes in justhtml
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.