Medium
CVE-2026-33230
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 738
Reset filters
High
CVE-2026-32874
UltraJSON has a Memory Leak parsing large integers allows DoS
Critical
CVE-2026-33057
Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py
Critical
CVE-2026-33054
Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion
High
CVE-2026-30922
Denial of Service in pyasn1 via Unbounded Recursion
Critical
Exploited in attacks
CVE-2026-33017
Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint
High
CVE-2026-28490
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
High
CVE-2026-28498
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
Critical
CVE-2026-27962
Authlib JWS JWK Header Injection: Signature Verification Bypass
Medium
ghsa-r48f-3986-4f9c
fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist
High
CVE-2026-32597
PyJWT accepts unknown `crit` header extensions
High
CVE-2026-31899
CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification
Critical
CVE-2026-27825
MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment
High
CVE-2026-30930
Glances has SQL Injection via Process Names in TimescaleDB Export
High
CVE-2026-29778
pyLoad has an Arbitrary File Write via Path Traversal in edit_package()
Medium
CVE-2026-29038
changedetection.io has Reflected XSS in its RSS Tag Error Response
High
CVE-2026-28802
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
Medium
CVE-2026-28348
lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes
Medium
CVE-2026-28277
LangGraph checkpoint loading has unsafe msgpack deserialization
High
ghsa-5hwf-rc88-82xm
Fickling missing RCE-capable modules in UNSAFE_IMPORTS
High
ghsa-wccx-j62j-r448
Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked
Critical
CVE-2026-3490
PickleScan's pkgutil.resolve_name has a universal blocklist bypass
Critical
CVE-2026-53873
PickleScan's profile.run blocklist mismatch allows exec() bypass
Low
CVE-2026-27167
Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.