Critical
CVE-2026-40088
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,855
Reset filters
Critical
Exploited in attacks
CVE-2026-39987
Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
Medium
CVE-2026-39892
Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs
Medium
CVE-2026-39844
NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
Critical
CVE-2026-39888
PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
Critical
CVE-2026-39890
PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading
Medium
CVE-2026-5600
A new API endpoint introduced in pretix 2025 that is supposed to
Low
CVE-2026-5751
justhtml: Mutation XSS with custom foreign-namespace sanitization policies
High
ghsa-69x8-hrgq-fjj8
LiteLLM: Password hash exposure and pass-the-hash authentication bypass
High
CVE-2026-39847
Emmett has a path traversal in internal assets handler
Medium
CVE-2026-39373
JWCrypto: JWE ZIP decompression bomb
High
CVE-2026-39376
FastFeedParser has an infinite redirect loop DoS via meta-refresh chain
Medium
CVE-2026-35592
pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass
Medium
CVE-2026-35586
pyload-ng: Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng
High
CVE-2026-35523
strawberry-graphql: Authentication bypass via legacy graphql-ws WebSocket subprotocol
High
CVE-2026-35526
strawberry-graphql: Denial of Service via unbounded WebSocket subscriptions
Critical
CVE-2026-35490
changedetection.io Vulnerable to Authentication Bypass via Decorator Ordering
Low
CVE-2026-4292
Django vulnerable to privilege abuse in ModelAdmin.list_editable
Low
CVE-2026-4277
Django vulnerable to privilege abuse in GenericInlineModelAdmin
High
CVE-2026-3902
Django vulnerable to ASGI header spoofing via underscore/hyphen conflation
High
CVE-2026-35463
pyLoad: Improper Neutralization of Special Elements used in an OS Command
High
CVE-2026-33034
Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit
Medium
CVE-2026-33033
Django has potential DoS via MultiPartParser through crafted multipart uploads
Medium
CVE-2026-33866
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.