Krytyczna
CVE-2026-7302
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 2 015
Wyczyść filtry
Wysoka
CVE-2026-2652
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and
Wysoka
CVE-2026-56398
Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
Średnia
ghsa-g39v-cvjh-8fpf
Home Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/
Średnia
CVE-2026-44439
Playwright Capture permits access to local files and internal network resources during page capture
Wysoka
CVE-2026-42304
Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
Wysoka
CVE-2026-42266
JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
Średnia
CVE-2026-86255
wger has an Uncontrolled Resource Consumption issue
Wysoka
CVE-2026-45134
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
Średnia
CVE-2026-44223
vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters
Krytyczna
CVE-2026-31238
Ludwig framework is vulnerable to insecure deserialization in its model serving component
Krytyczna
CVE-2026-31234
Horovod contains an insecure deserialization vulnerability in its KVStore HTTP server component
Krytyczna
CVE-2026-31220
PySyft server-side arbitrary Python execution after code approval
Krytyczna
CVE-2025-65719
Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page
Wysoka
CVE-2026-43891
changedetection.io has an Arbitrary Local File Read via a crafted backup restore
Wysoka
CVE-2026-2614
MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem
Wysoka
CVE-2026-2393
A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/server/handlers.py` accepts a user-controlled `url` parameter w
Wysoka
CVE-2026-42860
edx-enterprise has SSRF via SAML metadata URL in sync_provider_data endpoint
Wysoka
CVE-2026-42313
pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
Średnia
CVE-2026-42312
pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
Średnia
ghsa-88q9-cmp2-c2vq
oxidize-pdf: NaN/inf bypass in colour content-stream emission causes PDF rejection (DoS)
Krytyczna
CVE-2026-44336
PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection
Średnia
CVE-2026-43826
The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedd
Średnia
CVE-2026-41018
Apache Airflow Providers Elasticsearch: Elasticsearch task-log handlers leak credentials embedded in the host URL
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.