Medium
CVE-2024-8238
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 431
Reset filters
High
CVE-2025-24359
ASTEVAL Allows Maliciously Crafted Format Strings to Lead to Sandbox Escape
High
CVE-2025-22153
try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter
Medium
CVE-2024-5629
PyMongo Out-of-bounds Read in the bson module
Medium
CVE-2024-34064
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
Medium
CVE-2024-24808
pyLoad open redirect vulnerability due to improper validation of the is_safe_url function
Medium
CVE-2024-22195
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
High
CVE-2023-32731
Connection confusion in gRPC
Medium
CVE-2019-10047
PyDio Stored XSS Vulnerability
Medium
CVE-2006-1711
Plone allows remote users to modify arbitrary portraits
Critical
CVE-2026-38360
dash-uploader has a directory traversal vulnerability
Critical
CVE-2025-15379
MLflow Command Injection vulnerability
Critical
CVE-2026-32871
FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
Critical
CVE-2025-43859
h11 accepts some malformed Chunked-Encoding bodies
Critical
ghsa-98x5-vq43-vc5p
semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin
High
CVE-2026-33760
Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints
High
CVE-2025-71357
Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand
Critical
CVE-2026-55447
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
Medium
CVE-2026-48776
LangGraph SDK has unsafe URL path construction
High
ghsa-69qj-pvh9-c5wg
yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp
Medium
CVE-2026-91992
Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse
Critical
CVE-2026-47708
MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper
Critical
CVE-2026-44182
Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering
Critical
CVE-2026-44181
Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.