Alta
ghsa-8qx3-8gm5-9cj2
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.445
Alta
ghsa-8cp3-qxj6-px34
utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion
Media
CVE-2026-12210
utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins
Alta
ghsa-9qhg-99ww-9mqc
utcp-http SSRF: HTTP tool invocation follows redirects without re-validating the target
Crítica
CVE-2026-19632
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
Alta
CVE-2026-55522
PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code
Crítica
CVE-2026-79657
NLTK: Allowlisted pickle loaders still permit code execution in current source
Sin evaluar
CVE-2026-78684
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to ini
Crítica
CVE-2026-78683
NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution
Crítica
CVE-2026-78676
GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE
Alta
CVE-2026-78677
GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
Media
CVE-2026-78678
GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()
Alta
CVE-2026-78681
NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses
Alta
CVE-2026-78682
NLTK: pathsec SSRF protection can be bypassed when a proxy is configured
Alta
CVE-2026-78675
GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)
Media
CVE-2026-78125
LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Information Exposure
Alta
CVE-2026-78292
Hash Form – Drag & Drop Form Builder <= 1.4.1 - Unauthenticated PHP Object Injection
Alta
CVE-2026-77016
Workeera – AI Job Board with Applicant Tracking System (ATS) < 1.0.6 - Authenticated (Subscriber+) Arbitrary File Deletion
Alta
CVE-2026-78286
Geo Controller <= 8.9.8 - Unauthenticated PHP Object Injection
Media
CVE-2026-13416
CMP – Coming Soon & Maintenance Plugin by NiteoThemes < 4.1.18 - Authenticated (Editor+) Stored Cross-Site Scripting
Alta
CVE-2026-78271
FluentCRM Pro <= 3.1.12 - Authenticated (Editor+) Privilege Escalation
Media
CVE-2026-78285
Like Button Rating ♥ LikeBtn <= 2.6.61 - Authenticated (Subscriber+) SQL Injection
Alta
CVE-2026-78257
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.5 - Authenticated (Contributor+) PHP Object Injection
Alta
CVE-2026-75977
Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.