High
CVE-2026-25580
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,855
Reset filters
Critical
CVE-2026-25632
EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)
Medium
CVE-2026-1312
Django has an SQL Injection issue
High
CVE-2026-1287
Django has an SQL Injection issue
High
CVE-2026-1207
Django has an SQL Injection issue
Low
CVE-2026-1285
Django has Inefficient Algorithmic Complexity
Low
CVE-2025-14550
Django has Inefficient Algorithmic Complexity
Low
CVE-2025-13473
Django has Observable Timing Discrepancy
Medium
CVE-2025-70960
A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
Medium
CVE-2025-70959
A stored cross-site scripting (XSS) vulnerability in the Jobs module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
Critical
CVE-2026-25505
Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication
Critical
CVE-2026-25481
Langroid has WAF Bypass Leading to RCE in TableChatAgent
Critical
CVE-2024-5986
H2O has an External Control of File Name or Path vulnerability
Medium
CVE-2020-37044
OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can inject arbitrary JavaScript code by sending a crafted GET request with a malicio
High
CVE-2020-37041
OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary files from the filesystem by sending crafted GET requests with p
High
CVE-2025-69662
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
Critical
CVE-2026-25130
CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection
Critical
CVE-2026-40035
Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)
Unrated
pysec-2026-1
A single post-release of dydx-v4-client contained obfuscated multi-stage loader
Medium
CVE-2020-36962
Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads
Medium
ghsa-gpx9-96j6-pp87
TaskWeaver has Protection Mechanism Failure and Server-Side Request Forgery (SSRF)
High
CVE-2026-24747
PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.
Critical
CVE-2026-22696
dcap-qvl has Missing Verification for QE Identity
High
CVE-2025-67221
orjson does not limit recursion for deeply nested JSON documents
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.