High
CVE-2026-76236
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,855
Reset filters
Critical
CVE-2026-55447
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
High
ghsa-rpj2-4hq8-938g
VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files
High
ghsa-p5wc-9w9r-m232
Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser
High
ghsa-8823-qg2x-pv9f
Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit
High
CVE-2026-54527
jupyterlab-git extension: Stored XSS leading to RCE
High
CVE-2026-66065
ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys
Medium
CVE-2026-67338
JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol
High
CVE-2026-57586
agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
Medium
CVE-2026-58653
praisonai-platform: Authorization Bypass Through User-Controlled Key
Medium
CVE-2026-57204
pypdf: Missing stream length values ignore defined limits
Critical
CVE-2026-47103
python-statemachine SCXML <data expr> Eval Injection
Critical
CVE-2026-57125
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
High
CVE-2026-57112
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
Medium
CVE-2026-48817
Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
High
CVE-2026-48818
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
Critical
CVE-2026-50203
Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory
Medium
CVE-2026-48776
LangGraph SDK has unsafe URL path construction
High
ghsa-69qj-pvh9-c5wg
yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp
Medium
ghsa-gj48-438w-jh9v
Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes
Medium
ghsa-g75f-g53v-794x
Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning
Low
ghsa-8rfp-98v4-mmr6
Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output
Medium
CVE-2026-91992
Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse
High
ghsa-537c-gmf6-5ccf
Vulnerable OpenSSL included in cryptography wheels
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.