Alta
CVE-2026-59152
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 4.358
Restablecer filtros
Media
CVE-2026-58266
Anki: User scripts in iframes have access to the internal Anki API
Media
CVE-2026-58198
ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer
Alta
CVE-2026-58499
EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id
Alta
CVE-2026-76238
stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)
Alta
CVE-2026-76237
stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)
Alta
CVE-2026-76236
stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)
Crítica
CVE-2026-55447
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
Alta
ghsa-rpj2-4hq8-938g
VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files
Alta
ghsa-p5wc-9w9r-m232
Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser
Alta
ghsa-8823-qg2x-pv9f
Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit
Alta
CVE-2026-54527
jupyterlab-git extension: Stored XSS leading to RCE
Alta
CVE-2026-66065
ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys
Media
CVE-2026-67338
JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol
Alta
CVE-2026-57586
agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
Media
CVE-2026-58653
praisonai-platform: Authorization Bypass Through User-Controlled Key
Crítica
CVE-2026-47103
python-statemachine SCXML <data expr> Eval Injection
Crítica
CVE-2026-57125
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
Alta
CVE-2026-57112
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
Media
CVE-2026-48817
Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
Alta
CVE-2026-48818
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
Crítica
CVE-2026-50203
Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory
Media
CVE-2026-48776
LangGraph SDK has unsafe URL path construction
Alta
ghsa-69qj-pvh9-c5wg
yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.