High
CVE-2025-68438
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,358
Reset filters
High
CVE-2024-58339
LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The custom_query() l
High
CVE-2024-14021
LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The
High
CVE-2024-58340
LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/langchain/langchain/agents/mrkl/output_pa
High
CVE-2025-68472
MindsDB has improper sanitation of filepath that leads to information disclosure and DOS
Medium
CVE-2026-22773
vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions
Critical
CVE-2025-15346
wolfSSL Python module vulnerable to Improper Authentication
High
CVE-2026-21445
Langflow Missing Authentication on Critical API Endpoints
Medium
CVE-2025-69277
libsodium has Incomplete List of Disallowed Inputs
Medium
CVE-2025-68131
CBORDecoder reuse can leak shareable values across decode calls
High
CVE-2025-71367
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter
High
CVE-2025-71375
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller
High
CVE-2025-71372
Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef
Medium
CVE-2025-71347
Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.param_eval
High
CVE-2025-71373
Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller
High
CVE-2025-71362
Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef
High
ghsa-vqmv-47xg-9wpr
Picklescan missing detection when calling pty.spawn
High
ghsa-rcfx-77hg-w2wv
FastMCP updated to MCP 1.23+ due to CVE-2025-66416
High
CVE-2025-68478
External Control of File Name or Path in Langflow
High
CVE-2025-63387
Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials o
Critical
CVE-2025-67895
Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context
Medium
CVE-2025-67715
Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)
High
CVE-2025-67748
Fickling has Code Injection vulnerability via pty.spawn()
Medium
CVE-2025-67492
Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.