Medium
CVE-2026-39921
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,855
Reset filters
Medium
CVE-2026-39922
GeoNode contains a server-side request forgery vulnerability in the service registration endpoint
Medium
ghsa-vj8v-p5vw-m6v5
xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern
High
CVE-2026-40177
ajenti.plugin.core has password bypass when 2FA is activated
Low
CVE-2026-114110
uv vulnerable to arbitrary file deletion through RECORD entries
Critical
CVE-2026-40289
PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions
Critical
CVE-2026-40288
PraisonAI has critical RCE via `type: job` workflow YAML
High
CVE-2026-40287
PraisonAI Vulnerable to RCE via Automatic tools.py Import
Medium
CVE-2026-56074
PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands
High
ghsa-x462-jjpc-q4q4
PraisonAI: Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint
Critical
CVE-2026-40157
PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`
Critical
CVE-2026-40154
PraisonAI Vulnerable Untrusted Remote Template Code Execution
High
CVE-2026-56075
PraisonAI: Hardcoded `approval_mode="auto"` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command Execution
Critical
CVE-2026-40111
PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)
Medium
CVE-2026-5388
justhtml includes multiple security fixes
Medium
CVE-2026-40086
Rembg has a Path Traversal via Custom Model Loading
Critical
CVE-2026-1115
parisneo/lollms vulnerable to stored XSS in the social feature
Medium
CVE-2026-33551
An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application
Medium
ghsa-9gjv-jvm7-vv2v
Gramps Web API: Private Sub-Object Data in Non-Private Objects Exposed to Guest Users
Medium
CVE-2026-34983
Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be trigg
High
CVE-2026-39980
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage
High
CVE-2026-39981
AGiXT Vulnerable to Path Traversal in safe_join()
High
CVE-2025-14551
In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include cer
Medium
CVE-2026-34538
Apache Airflow has an authorization bypass in DagRun wait endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.