Medium
CVE-2026-38743
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,358
Reset filters
Critical
CVE-2025-62373
Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer
High
CVE-2026-41241
pretalx vulnerable to stored cross-site scripting in organizer search typeahead
Critical
CVE-2026-3960
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient secu
Medium
CVE-2026-6827
justhtml has sanitization bypass in custom policies and programmatic DOM
Medium
CVE-2026-40594
pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)
Medium
CVE-2026-39377
nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames
Medium
CVE-2026-35588
Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values
High
CVE-2026-35587
Glances has SSRF in IP Plugin via public_api leading to credential leakage
High
CVE-2026-34839
Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS
Medium
CVE-2026-28684
python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback
Low
CVE-2026-32690
Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries
High
CVE-2026-25917
Apache Airflow allows code execution through crafted XCom payloads
Medium
CVE-2026-30912
Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false
High
CVE-2026-32228
Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions
Medium
CVE-2026-40491
gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall
High
CVE-2026-41496
PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)
Critical
CVE-2026-41497
PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection
Critical
CVE-2026-27197
Sentry: Improper authentication on SAML SSO process allows user identity linking
High
CVE-2026-31987
Apache Airflow: JWT token appearing in logs
High
CVE-2025-54550
Apache Airflow: RCE by race condition in example_xcom dag
Medium
CVE-2026-41182
LangSmith SDK: Streaming token events bypass output redaction
Medium
CVE-2026-40256
Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision
Medium
CVE-2026-34244
Weblate: SSRF via Project-Level Machinery Configuration
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.