Medium
CVE-2026-42867
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,003
Reset filters
High
CVE-2026-48099
WsgiDAV encoded dot segments can escape filesystem share roots
High
CVE-2026-47781
PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing
Medium
CVE-2026-47763
PDM: Project-Local State and Config Writes Follow Symlinks
Medium
CVE-2026-48053
Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset
Medium
CVE-2026-54445
Vantage6: Set admin user and password from environment or configuration
High
CVE-2026-48060
Litestar has HTML Injection Through its CSRF Token
Medium
CVE-2026-48061
Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header
Low
CVE-2026-47712
Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`
Medium
CVE-2026-47734
Dulwich has unbounded memory allocation in receive-pack from crafted thin packs
Low
CVE-2024-24769
Vantage6: No limit on emails sent for password/MFA reset
Medium
CVE-2024-27928
Vantage6: 2FA can be circumvented with hacked email access
High
CVE-2026-44023
Docling Core: Unsafe remote filename resolution
High
CVE-2026-47417
praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR
High
CVE-2026-47405
PraisonAI Platform: Missing role checks let any workspace member become owner and control workspace membership
High
CVE-2026-48169
PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API
High
CVE-2026-47399
PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID
Low
CVE-2026-10177
Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint
High
CVE-2026-47394
PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate
Medium
CVE-2026-47213
BoxLite has a Timeout Bypass Vulnerability
High
CVE-2026-10108
xiaomusic contains an unauthenticated path traversal vulnerability
Medium
CVE-2026-46380
compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem
High
CVE-2026-46439
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
Medium
CVE-2026-45774
compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.