Medium
CVE-2026-44263
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,855
Reset filters
Medium
CVE-2026-44264
Weblate vulnerable to XSS via crafted Markdown
Medium
CVE-2026-41654
Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
Medium
CVE-2026-41519
Weblate Doesn't Invalidate API Token on Password Change
High
CVE-2026-44503
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
Critical
CVE-2026-44484
Compromise of PyTorch Lightning PyPi Package Versions
Medium
ghsa-7f4h-6264-89fr
axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
High
CVE-2026-0897
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (D
Critical
CVE-2026-44364
misp-modules website - Missing CSRF protection in the website home blueprint
Low
ghsa-7mw3-79jq-xc7f
aiograpi has dependency on vulnerable orjson 3.11.4 (CVE-2025-67221)
Medium
CVE-2026-86256
wger: trainer_login open redirect - ?next= parameter not validated against host
Critical
CVE-2026-43948
wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
High
CVE-2026-86257
wger: CSV/TSV formula injection in gym member export (first_name/last_name)
Critical
CVE-2026-29090
Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API
Critical
CVE-2026-29080
Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API
Low
ghsa-7ww3-xvf5-cxwm
ciguard: Web UI is missing HTTP defence-in-depth headers
High
CVE-2026-40110
Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`
High
CVE-2026-40934
Jupyter Server's Authentication Cookies Remain Valid After Password Reset and Server Restart
High
CVE-2026-35397
Jupyter Server: Path Traversal via incorrect startswith() root directory check allows access to sibling directories
Critical
CVE-2026-42196
django-s3file is vulnerable to relative path traversal
Critical
CVE-2026-27960
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploit
Critical
CVE-2026-42048
Langflow Knowledge Bases API is Vulnerable to Path Traversal
Critical
CVE-2026-42864
FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft
Critical
CVE-2026-25660
Codechecker has an authentication bypass for certain API calls
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.