Medium
CVE-2026-105754
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 738
Reset filters
Medium
CVE-2026-102991
Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
Medium
CVE-2026-105753
vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core
High
CVE-2026-104851
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
Critical
CVE-2026-8505
Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass
High
CVE-2026-51886
Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description
Medium
CVE-2026-105749
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
High
CVE-2026-71416
Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)
Critical
CVE-2026-114108
Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
Critical
CVE-2026-114107
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
High
CVE-2026-114094
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
High
CVE-2026-114096
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
High
CVE-2026-114097
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
High
CVE-2026-114098
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
Medium
CVE-2026-101918
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
Medium
CVE-2026-102269
PyJWT: Non-canonical signature segments enable raw-token revocation bypass
High
CVE-2026-102272
PyJWT BOM Bypass
High
CVE-2026-102266
PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
Medium
CVE-2026-102270
PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
Medium
CVE-2026-49264
Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
High
CVE-2026-57171
Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
Critical
CVE-2026-91130
Home Assistant: XSS in Statistics Graph Card
Medium
CVE-2026-86062
lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content
Medium
CVE-2026-83801
Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.