High
CVE-2026-27905
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 704
Reset filters
Medium
CVE-2026-27695
zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service
Medium
CVE-2025-65995
Apache Airflow error reporting may expose full kwargs
High
CVE-2026-26331
yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
High
CVE-2026-2033
MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability
Medium
CVE-2026-27025
pypdf has possible long runtimes/large memory usage for large /ToUnicode streams
High
CVE-2026-1669
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
High
CVE-2026-25577
Emmett-Core: Unhandled CookieError Exception Causing Denial of Service
High
CVE-2026-1707
pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability
High
CVE-2026-56259
Crawl4AI: LLM credential exfiltration in Docker server via request base_url and env: token resolution
High
CVE-2026-73496
mcp-atlassian: Arbitrary server-side file read via attachment upload
Medium
ghsa-9mqm-qcwf-5qhg
CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources
Medium
ghsa-mxwc-wh95-pw4g
Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler
High
CVE-2026-59939
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
High
CVE-2026-59925
Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
Medium
CVE-2026-59929
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
Medium
CVE-2026-59927
Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
High
CVE-2026-59922
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
Low
CVE-2026-14966
BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the
Medium
ghsa-f66q-9rf6-8795
Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion
High
CVE-2026-1777
SageMaker Python SDK has Exposed HMAC
Low
CVE-2026-1703
pip Path Traversal vulnerability
High
CVE-2026-24123
BentoML has a Path Traversal via Bentofile Configuration
Medium
CVE-2026-23892
OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.