Vulnerabilidades conocidas
| CVE | Título | Versiones afectadas | CVSS | Explotada | EPSS | Publicación |
|---|---|---|---|---|---|---|
| CVE-2026-41487 | Langfuse: Improper role-based-access control in Langfuse LLM connection management allowed users of role “memb... | * | 5.3 | — | 2026-05-08 | |
| CVE-2026-24055 | Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking | * | 6.3 | — | 2026-01-22 | |
| CVE-2025-65107 | Langfuse SSO Account Takeover via CSRF or phishing attack | * | 6.5 | — | 2025-11-22 | |
| CVE-2025-64504 | Langfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIs | * | 5.0 | — | 2025-11-11 |
Controla estas versiones en tus propios servidores
InfraGuard recopila las versiones de software instaladas en cada servidor y señala las que tienen vulnerabilidades conocidas. Autoalojado: nada sale de tu red.
Datos: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (consulta EPSS en https://www.first.org/epss), endoflife.date. Lista de software: awesome-selfhosted (CC BY-SA 3.0).