Medium
CVE-2026-24098
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,358
Reset filters
Medium
CVE-2026-22922
Apache Airflow Has an Authorization Bypass That Allows Unauthorized Task Log Access
Medium
CVE-2026-25516
NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
High
CVE-2026-25732
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
Critical
ghsa-4f84-67cv-qrv3
A single post-release of dydx-v4-client contained obfuscated multi-stage loader
High
CVE-2026-25640
Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL
Critical
CVE-2026-25592
Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK
High
CVE-2026-25580
Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling
Medium
CVE-2026-1312
Django has an SQL Injection issue
Low
CVE-2026-1285
Django has Inefficient Algorithmic Complexity
Critical
CVE-2026-25505
Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication
Critical
CVE-2026-25481
Langroid has WAF Bypass Leading to RCE in TableChatAgent
Critical
CVE-2024-5986
H2O has an External Control of File Name or Path vulnerability
Medium
CVE-2020-37044
OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can inject arbitrary JavaScript code by sending a crafted GET request with a malicio
High
CVE-2020-37041
OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary files from the filesystem by sending crafted GET requests with p
High
CVE-2025-69662
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
Critical
CVE-2026-25130
CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection
Critical
CVE-2026-40035
Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)
Unrated
pysec-2026-1
A single post-release of dydx-v4-client contained obfuscated multi-stage loader
Medium
CVE-2020-36962
Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads
Medium
ghsa-gpx9-96j6-pp87
TaskWeaver has Protection Mechanism Failure and Server-Side Request Forgery (SSRF)
Critical
CVE-2026-22696
dcap-qvl has Missing Verification for QE Identity
Medium
CVE-2026-22218
Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value,
High
CVE-2025-68675
Apache Airflow proxy credentials for various providers might leak in task logs
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.