Medium
ghsa-qp9x-wp8f-qgjj
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,855
Reset filters
Medium
CVE-2026-47144
Shamefile has an arbitrary file read via shamefile.yaml in shame next
Medium
CVE-2026-44394
OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token
Medium
CVE-2026-43000
OpenStack Keystone has an Incorrect Authorization issue
Medium
CVE-2026-42998
OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential
Medium
CVE-2026-42999
OpenStack Keystone has an Authorization Bypass
High
CVE-2026-44798
Nautobot: GitRepository.current_head field should not be writable through REST API
High
CVE-2026-44797
Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)
Medium
CVE-2026-44796
Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)
Medium
CVE-2026-44794
Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference
Medium
CVE-2026-45076
Synapse pagination Denial of Service
High
CVE-2026-45078
Synapse CPU starvation (Denial of Service)
High
CVE-2026-48526
PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
Medium
CVE-2026-48525
PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS
Low
CVE-2026-48524
PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
Medium
CVE-2026-48523
PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys
Medium
CVE-2026-48522
PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes
High
CVE-2026-45017
python-liquid: Absolute paths escape filesystem loader search path
High
CVE-2026-44660
UltraJSON has a Memory Leak in ujson.dump() on Write Failure
Medium
CVE-2026-44681
Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect
High
CVE-2026-44345
BentoML Dockerfile command injection via docker.base_image (sister of pending GHSA-w2pm-x38x-jp44 / CVE-2026-33744 / CVE-2026-35043)
High
CVE-2026-44346
Dockerfile command injection via envs[*].name in bentofile.yaml (sibling fix-bypass of CVE-2026-33744 and CVE-2026-35043)
Medium
CVE-2026-44353
Streamlink has an arbitrary local file read via file:// URI in HLS and DASH
Medium
CVE-2026-48545
Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.