High
CVE-2026-44340
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 456
Reset filters
High
CVE-2026-44338
PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
Medium
CVE-2026-44844
eml_parser has recursion DoS via nested message/rfc822 attachments
Medium
CVE-2026-44560
Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search
High
CVE-2026-44209
banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI
High
CVE-2026-44555
Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
High
CVE-2026-44556
Open WebUI's responses passthrough endpoint lacks access control authorization
High
CVE-2026-44334
PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)
Medium
CVE-2026-44520
docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler
High
CVE-2026-44307
Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup
Low
CVE-2026-44220
ciguard: discover_pipeline_files follows symlinks out of scan root
High
CVE-2026-42301
pyp2spec is Vulnerable to Code Injection
Medium
CVE-2026-6357
pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
Medium
CVE-2026-3219
pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files
High
CVE-2026-41490
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
Low
CVE-2026-40319
Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check
Medium
CVE-2026-40159
PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution
High
CVE-2026-40160
PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback
High
CVE-2026-40158
PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure
High
CVE-2026-40156
PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading
High
CVE-2026-40153
PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool
High
CVE-2026-40113
PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars
Medium
CVE-2026-40112
PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)
Medium
CVE-2026-33753
rfc3161-client Has Improper Certificate Validation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.