Critical
CVE-2021-21386
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,855
Reset filters
Critical
CVE-2026-49257
mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind
Medium
ghsa-75mw-h36v-2jv7
Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers
Critical
ghsa-98x5-vq43-vc5p
semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin
Medium
ghsa-m8j6-rc5x-wv36
nono-py's policy JSON accepts unknown security fields
Medium
ghsa-9j7f-3r4p-pwh6
nono-py vulnerable to authorization bypass / policy confusion
Critical
CVE-2026-48797
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
Medium
ghsa-72w7-mf9g-733p
nono-py has proxy-only network fallback bypass on older Linux kernels
Medium
CVE-2026-48782
pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)
Unrated
pysec-2026-236
Malicious code in pyphetools (PyPI)
High
CVE-2026-47214
Docling: Unsafe URI and Path Handling in HTML Backend
Medium
CVE-2026-44018
Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
Unrated
pysec-2026-235
Malicious code in ppkt2synergy (PyPI)
Unrated
pysec-2026-234
Malicious code in phenopacket-store-toolkit (PyPI)
High
CVE-2026-49486
The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was trans
Critical
CVE-2026-55166
Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise
Medium
CVE-2026-77088
justhtml: to_markdown() code-span blank-line breakout enables XSS
Unrated
pysec-2026-233
Malicious code in gpsea (PyPI)
Unrated
pysec-2026-231
Malicious code in embiggen (PyPI)
Medium
CVE-2026-44022
Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands
High
CVE-2026-44017
Docling: Unsafe Zip Extraction in EasyOCR Model Download
High
CVE-2026-44020
Docling: Unsafe XML Entity Expansion in USPTO Patent Backend
High
CVE-2026-44016
Docling: Unsafe Playwright-based HTML Rendering
Unrated
pysec-2026-232
Malicious code in ensmallen (PyPI)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.