Medium
CVE-2026-61440
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 696
Reset filters
Medium
CVE-2026-60090
PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL
Low
CVE-2026-107293
Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`
Medium
CVE-2026-107290
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
Low
CVE-2026-107291
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
High
CVE-2026-61439
PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats
Medium
CVE-2026-105748
Docling: Crafted DoclingDocument JSON embeds local image files into converted output
Medium
CVE-2026-106454
Twisted: IMAP wildcardToRegexp() ReDoS
High
CVE-2026-61436
PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
High
CVE-2026-61428
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
High
CVE-2026-43976
wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
Medium
ghsa-vg88-3v92-rjx2
Vyper: Return inside for loop more than 1 level deep
Critical
CVE-2026-10561
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
Medium
CVE-2026-105760
vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion
Medium
CVE-2026-105754
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
Medium
CVE-2026-105756
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service
Medium
CVE-2026-104843
uv: Path traversal on Windows through wheel extraction
Medium
CVE-2026-104874
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
High
CVE-2026-105759
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for reques
Medium
CVE-2026-105751
Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
Critical
CVE-2026-9205
Langflow: Weak Fernet Key via random.seed()
High
CVE-2026-51886
Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description
High
CVE-2026-7700
Langflow: Prompt injection in Langflow Smart Transform can lead to code execution
Medium
CVE-2026-105743
Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.