High
CVE-2026-105699
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 456
Reset filters
High
CVE-2026-106443
WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE
Critical
CVE-2026-61444
PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
High
CVE-2026-61428
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
Low
CVE-2026-105752
vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle
Medium
CVE-2026-105754
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
Medium
CVE-2026-105756
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service
Medium
CVE-2026-104874
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
Medium
CVE-2026-105755
vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`
Medium
CVE-2026-105757
vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)
Medium
CVE-2026-105753
vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core
High
CVE-2026-104851
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
High
ghsa-v853-p72q-4cfw
Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__
Critical
CVE-2026-9205
Langflow: Weak Fernet Key via random.seed()
High
CVE-2026-105744
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Medium
CVE-2026-105746
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/
Medium
CVE-2026-105749
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
Critical
CVE-2026-114107
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
Medium
CVE-2026-102274
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
High
CVE-2026-102266
PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
High
CVE-2026-102271
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
High
CVE-2026-57443
SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
Medium
CVE-2026-57179
social-auth-core has a Session Fixation issue
Medium
CVE-2026-49264
Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.