Średnia
CVE-2026-55530
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 733
Wyczyść filtry
Wysoka
CVE-2026-55537
PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114
Krytyczna
CVE-2026-53710
mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
Średnia
CVE-2026-55529
PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server
Krytyczna
CVE-2026-61539
Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing
Średnia
CVE-2026-75526
django CMS: Stored XSS in edit-mode plugin exception rendering
Wysoka
CVE-2026-76220
GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution
Wysoka
CVE-2026-53951
Copier has a trust-prefix bypass via path traversal that runs tasks unprompted
Wysoka
CVE-2026-67325
GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
Wysoka
CVE-2026-87819
GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing
Wysoka
CVE-2026-87817
GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution
Średnia
CVE-2026-73262
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
Średnia
CVE-2026-81724
NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input
Nieoceniona
CVE-2026-81717
openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted (attacker with physical
Nieoceniona
CVE-2026-81693
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger un
Średnia
CVE-2026-81680
openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slots without re-encrypting the payload. Att
Wysoka
ghsa-vwf3-4xxj-qg6h
mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment
Wysoka
ghsa-8cp3-qxj6-px34
utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion
Wysoka
CVE-2026-55522
PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code
Krytyczna
CVE-2026-79657
NLTK: Allowlisted pickle loaders still permit code execution in current source
Krytyczna
CVE-2026-78683
NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution
Krytyczna
CVE-2026-78676
GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE
Wysoka
CVE-2026-78677
GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
Wysoka
CVE-2026-78681
NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.