Low
CVE-2026-23983
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,358
Reset filters
High
CVE-2026-23984
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
CVE-2026-27483
MindsDB: Path Traversal in /api/files Leading to Remote Code Execution
Critical
CVE-2026-26198
ormar is vulnerable to SQL Injection through aggregate functions min() and max()
Medium
CVE-2026-27482
Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
Medium
CVE-2026-27199
Werkzeug safe_join() allows Windows special device names
Low
CVE-2026-27205
Flask session does not add `Vary: Cookie` header when accessed in some ways
Low
ghsa-83pf-v6qq-pwmr
Fickling has a detection bypass via stdlib network-protocol constructors
Medium
CVE-2026-25739
Indico Affected by Cross-Site-Scripting via material uploads
Medium
CVE-2026-25738
Indico has Server-Side Request Forgery (SSRF) in multiple places
Medium
CVE-2026-25527
changedetection.io is vulnerable to unauthenticated static path traversal
Critical
CVE-2025-14009
NLTK has a Zip Slip Vulnerability
High
CVE-2026-2653
A security flaw has been discovered in admesh up to 0.98.5. This issue affects the function stl_check_normal_vector of the file src/normals.c. Performing a manipulation results in heap-based buffer ov
High
CVE-2026-25087
Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering
Medium
CVE-2026-2415
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name}
Medium
CVE-2019-25338
DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valid user accounts. Attackers can submit different usernames t
Critical
CVE-2026-26217
Crawl4AI Has Local File Inclusion in Docker API via file:// URLs
Critical
CVE-2026-26216
Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter
High
CVE-2026-26007
cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
Critical
CVE-2026-21531
Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE
Medium
CVE-2026-25528
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
Medium
CVE-2026-25480
Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)
Medium
CVE-2026-25479
Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns
High
CVE-2026-25478
Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.