Medium
CVE-2026-28277
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,855
Reset filters
High
CVE-2026-25048
xgrammar vulnerable to DoS via multi-layer nesting
Medium
CVE-2025-69534
Python-Markdown has an Uncaught Exception
Medium
CVE-2026-27982
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to a
High
CVE-2026-0847
A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and Brack
High
ghsa-5hwf-rc88-82xm
Fickling missing RCE-capable modules in UNSAFE_IMPORTS
High
ghsa-wccx-j62j-r448
Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked
Critical
CVE-2026-3490
PickleScan's pkgutil.resolve_name has a universal blocklist bypass
Critical
CVE-2026-53873
PickleScan's profile.run blocklist mismatch allows exec() bypass
High
CVE-2026-28416
Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing
Medium
CVE-2026-28415
Gradio has an Open Redirect in its OAuth Flow
High
CVE-2026-28414
Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+
Low
CVE-2026-27167
Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret
Medium
CVE-2026-28352
Indico has a missing access check in the event series management API
Medium
CVE-2026-28231
pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read
Medium
ghsa-747p-wmpv-9c78
AWS CLI: cli_history database does not restrict file permissions on Unix systems
Critical
CVE-2026-27966
Langflow has Remote Code Execution in CSV Agent
Critical
CVE-2026-28370
OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection
Medium
CVE-2026-27457
Weblate: Missing access control for the AddonViewSet API exposes all addon configurations
High
CVE-2026-27961
Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator template rendering. Although the vul
Critical
CVE-2026-27941
OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out a
Medium
CVE-2026-27948
Copyparty vulnerable to reflected XSS via setck parameter
Critical
CVE-2026-27952
Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability existed in Agenta's custom code evaluator. Agenta used RestrictedPython as a sand
Medium
CVE-2026-27809
psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.