Medium
CVE-2026-41182
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,855
Reset filters
High
CVE-2026-40192
FITS GZIP decompression bomb in Pillow
Medium
CVE-2026-40256
Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision
Medium
CVE-2026-39845
Weblate: SSRF via the webhook add-on using unprotected fetch_url()
High
CVE-2026-34393
Weblate: Privilege escalation in the user API endpoint
High
CVE-2026-34242
Weblate: Arbitrary File Read via Symlink
Medium
CVE-2026-34244
Weblate: SSRF via Project-Level Machinery Configuration
Medium
CVE-2026-33440
Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads
High
CVE-2026-33435
Weblate: Remote code execution during backup restoration
Medium
CVE-2026-33220
Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
Critical
CVE-2026-30625
Upsonic: remote code execution vulnerability in its MCP server/task creation functionality
Medium
CVE-2026-33214
Weblate: Improper access control for the translation memory in API
Low
CVE-2026-33212
Weblate: Improper access control for pending tasks in API
Medium
CVE-2026-25219
Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access
Low
ghsa-fj52-5g4h-gmq8
pyLoad's Session Not Invalidated After Permission Changes
Low
CVE-2026-7808
Multiple security fixes in justhtml
Critical
CVE-2026-40576
excel-mcp-server has a Path Traversal issue
High
CVE-2026-33858
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly tru
Medium
CVE-2025-66236
Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI
Critical
CVE-2026-4810
Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability
Medium
CVE-2026-1116
A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The vulnerability arises from the lack of
Critical
CVE-2026-5059
aws-mcp has a Command Injection Remote Code Execution Vulnerability
Medium
ghsa-55v6-g8pm-pw4c
rembg server is vulnerable to Server-Side Request Forgery (SSRF) and a weak default CORS configuration
Critical
CVE-2026-40258
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.