Średnia
CVE-2026-73559
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 1 334
Wyczyść filtry
Wysoka
CVE-2026-68518
Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction
Średnia
CVE-2026-68517
Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard
Wysoka
CVE-2026-55071
MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`
Wysoka
CVE-2026-73417
JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
Wysoka
CVE-2026-73568
libp2p: yamux connection DoS via oversized data frame
Wysoka
CVE-2026-52776
compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
Wysoka
CVE-2026-73498
mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment
Wysoka
CVE-2026-55178
GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
Nieoceniona
CVE-2026-74889
openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key
Krytyczna
CVE-2026-74878
openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart
Wysoka
CVE-2026-73624
GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
Średnia
CVE-2026-73621
GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count
Wysoka
CVE-2026-73620
GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read
Wysoka
CVE-2026-73622
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
Średnia
CVE-2026-73619
GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()
Średnia
CVE-2026-68971
Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team, un
Wysoka
CVE-2026-68968
Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()`
Wysoka
CVE-2026-67422
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
Wysoka
CVE-2026-70492
Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
Średnia
CVE-2026-70488
Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
Wysoka
CVE-2026-70485
Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
Średnia
CVE-2026-54020
Open WebUI: DNS Rebinding SSRF Bypass
Średnia
CVE-2026-70489
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.