Critical
CVE-2026-44180
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 431
Reset filters
Critical
CVE-2026-47407
PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation
Medium
CVE-2026-47395
PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
Medium
CVE-2026-47390
PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
Critical
CVE-2026-76242
stigmem-node's federation peer registration lacked explicit out-of-band approval
High
CVE-2026-76240
stigmem-node's Postgres schema identifier handling required defensive quoting
Medium
CVE-2026-48525
PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS
High
CVE-2026-44345
BentoML Dockerfile command injection via docker.base_image (sister of pending GHSA-w2pm-x38x-jp44 / CVE-2026-33744 / CVE-2026-35043)
High
CVE-2026-44346
Dockerfile command injection via envs[*].name in bentofile.yaml (sibling fix-bypass of CVE-2026-33744 and CVE-2026-35043)
High
ghsa-mw8f-w6p8-xrf4
wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None
Critical
ghsa-wx9m-wx4f-4cmg
Malicious dropper in mistralai 2.4.6 PyPI package
High
CVE-2026-42860
edx-enterprise has SSRF via SAML metadata URL in sync_provider_data endpoint
Critical
CVE-2026-44336
PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection
High
ghsa-52cq-7v8r-62c6
gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense
High
CVE-2026-0897
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (D
Critical
CVE-2026-43948
wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
Critical
CVE-2026-29090
Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API
Critical
CVE-2026-29080
Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API
Medium
CVE-2025-61669
Jupyter Server has an open redirection vulnerability in `next` query parameter
Medium
CVE-2026-41426
pretalx mail templates vulnerable to email injection via unescaped user-controlled placeholders
High
CVE-2026-41066
lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files
High
CVE-2026-41241
pretalx vulnerable to stored cross-site scripting in organizer search typeahead
Medium
CVE-2026-35588
Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values
High
CVE-2026-34839
Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.