High
CVE-2026-39981
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 457
Reset filters
Critical
CVE-2026-40088
PraisonAI Vulnerable to OS Command Injection
Critical
Exploited in attacks
CVE-2026-39987
Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
High
CVE-2026-34824
Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service
High
CVE-2026-33641
Glances Vulnerable to Command Injection via Dynamic Configuration Values
Critical
CVE-2026-34953
PraisonAI Has Authentication Bypass via OAuthManager.validate_token()
Critical
CVE-2026-34952
PraisonAI Has Missing Authentication in WebSocket Gateway
Critical
CVE-2026-34935
PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()
Critical
CVE-2026-34938
PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code
Critical
ghsa-955r-262c-33jc
Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2
High
CVE-2026-33744
BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml
High
CVE-2026-33718
OpenHands is Vulnerable to Command Injection through its Git Diff Handler
High
CVE-2026-33236
NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite
High
CVE-2026-33154
dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver
High
CVE-2026-32608
Glances has a Command Injection via Process Names in Action Command Templates
High
CVE-2026-28500
ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
Critical
Exploited in attacks
CVE-2026-33017
Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint
High
CVE-2026-28490
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
High
CVE-2026-28498
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
Critical
CVE-2026-27962
Authlib JWS JWK Header Injection: Signature Verification Bypass
Medium
ghsa-r48f-3986-4f9c
fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist
Medium
CVE-2026-29780
eml_parser: Path Traversal in Official Example Script Leads to Arbitrary File Write
Medium
CVE-2026-29038
changedetection.io has Reflected XSS in its RSS Tag Error Response
High
CVE-2026-28802
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.