Medium
CVE-2024-7037
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 457
Reset filters
Medium
CVE-2024-45190
Mage AI Path Traversal vulnerability
Medium
CVE-2024-41951
PheonixAppAPI has visible Encoding Maps
High
CVE-2024-41950
Insecure Jinja2 templates rendered in Haystack Components can lead to RCE
Medium
CVE-2024-41671
twisted.web has disordered HTTP pipeline response
High
CVE-2023-41267
Apache HDFS Provider error message suggested
Medium
CVE-2023-39523
ScanCode.io command injection in docker image fetch process
High
CVE-2026-54060
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
Medium
CVE-2021-20180
Insertion of Sensitive Information into Log File in ansible
High
CVE-2026-57516
Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)
Critical
CVE-2026-48039
Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token
Critical
CVE-2026-22778
vLLM has RCE In Video Processing
Critical
CVE-2026-47393
PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default
Critical
CVE-2026-32871
FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
Critical
CVE-2025-53890
pyLoad vulnerable to XSS through insecure CAPTCHA
Critical
CVE-2025-65015
joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads
Critical
CVE-2025-47277
vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
Critical
CVE-2025-27520
BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
Critical
CVE-2026-49257
mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind
Medium
ghsa-75mw-h36v-2jv7
Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers
Critical
ghsa-98x5-vq43-vc5p
semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin
Critical
CVE-2026-48797
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
Medium
CVE-2026-77088
justhtml: to_markdown() code-span blank-line breakout enables XSS
High
CVE-2026-54293
Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.