Conoce las vulnerabilidades. Protege tus aplicaciones.

Alta 19.10.2026

CVE-2026-108372

Política CORS permisiva en serve-status de LoopX expone el estado del plano de control y archivos Markdown privados

La función serve-status de LoopX utiliza una política CORS permisiva con encabezados comodín en rutas de lectura loopback no autenticadas. Sitios web maliciosos visitados por el operador pueden extraer sin interacción el estado del plano de control y archivos Markdown privados de los repositorios registrados.

Python (PyPI)

loopx

Media 15.10.2026

CVE-2026-102682

Pipecat: La exposición pública del runner de desarrollo puede permitir la creación no autenticada de sesiones de bot

Exponer el runner de desarrollo de Pipecat a redes no confiables permite a usuarios no autenticados crear sesiones de bot y salas de Daily de pago. Esto puede derivar en interacciones no autorizadas con bots y en el consumo de recursos locales y cuotas de terceros.

Python (PyPI)

pipecat-ai

Media 09.10.2026

ghsa-9q47-3cm2-2rp8

pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

Python (PyPI)

pyload-ng

Media 05.10.2026

CVE-2026-102598

Werkzeug safe_join() allows Windows special device names

Python (PyPI)

werkzeug

Media 31.07.2026

CVE-2026-54707

OnionShare Receive mode writes uploaded files even when file uploads are disabled

Python (PyPI)

onionshare-cli

Alta 17.07.2026

CVE-2026-54567

Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

Python (PyPI)

flask-reuploaded

Alta 23.06.2026

CVE-2026-54134

OctoPrint has possible file exfiltration via query parameters on upload endpoints

Python (PyPI)

octoprint

Baja 15.06.2026

CVE-2026-53540

python-multipart: Negative Content-Length in parse_form buffers the entire body in memory

Python (PyPI)

python-multipart

Alta 27.05.2026

CVE-2026-48544

Taipy contains a path traversal vulnerability

Python (PyPI)

taipy

Media 08.01.2026

CVE-2026-21860

Werkzeug safe_join() allows Windows special device names with compound extensions

Python (PyPI)

werkzeug

Media 02.12.2025

CVE-2025-66221

Werkzeug safe_join() allows Windows special device names

Python (PyPI)

werkzeug

Media 25.10.2024

CVE-2024-49767

Werkzeug possible resource exhaustion when parsing file data in forms

Python (PyPI)

quart, werkzeug

Media 25.10.2024

CVE-2024-49766

Werkzeug safe_join not safe on Windows

Python (PyPI)

werkzeug

Alta 06.05.2024

CVE-2024-34069

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

Python (PyPI)

werkzeug

Media 07.10.2022

CVE-2021-23385

Flask-Security vulnerable to Open Redirect

Python (PyPI)

flask-security

Alta 24.05.2022

CVE-2019-14322

Pallets Werkzeug vulnerable to Path Traversal

Python (PyPI)

werkzeug

Crítica 09.05.2024

CVE-2024-32874

Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service

Python (PyPI)

frigate

Crítica 18.11.2025

CVE-2025-65015

joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads

Python (PyPI)

joserfc

Media 23.06.2026

ghsa-w2j7-f3c6-g8cw

Flask-Security has an Open Redirect issue

Python (PyPI)

flask-security

Media 16.04.2026

CVE-2026-40594

pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)

Python (PyPI)

pyload-ng

Alta 27.03.2026

CVE-2026-33981

Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters

Python (PyPI)

changedetection-io

Crítica 25.02.2026

CVE-2026-27641

Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

Python (PyPI)

flask-reuploaded

Media 19.02.2026

CVE-2026-27199

Werkzeug safe_join() allows Windows special device names

Python (PyPI)

werkzeug

Crítica 29.01.2026

CVE-2026-40035

Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)

Python (PyPI)

dfir-unfurl