High
CVE-2026-45331
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,016
Reset filters
High
CVE-2026-45315
Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
Medium
CVE-2026-45318
Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)
High
CVE-2026-45349
Open WebUI has Broken Access Control for Completions API
Medium
CVE-2026-45347
Open WebUI vulnerable to blind server side request forgery (SSRF) via the PDF generate function
Medium
CVE-2026-45317
Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation
High
CVE-2026-45350
Open WebUI's chat completion API allows tool restrictions to be bypassed
Medium
CVE-2026-45306
pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad
Medium
CVE-2026-45299
Open WebUI has Stored Cross-Site Scripting In Profile Picture
High
CVE-2026-44541
ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override
Medium
CVE-2026-44968
dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters
Low
CVE-2026-44970
dbt MCP Server Transmits All MCP Tool Arguments Including Raw SQL and --vars Credentials to dbt Labs Telemetry by Default Without Redaction
Low
CVE-2026-44969
dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled
High
CVE-2026-31225
Superduper: Remote code execution via unsafe eval in superduper query parsing
High
CVE-2026-31240
mem0 server lacks authentication and authorization controls for its memory management API endpoints
Medium
CVE-2026-31241
mem0 server lacks authentication and authorization controls for its memory deletion API endpoint
Medium
CVE-2026-31245
mem0 server lacks authentication and authorization controls for its memory creation API endpoint
High
CVE-2026-7815
SQL injection vulnerability in pgAdmin 4 Maintenance Tool
Medium
CVE-2026-7820
pgAdmin 4: Improper restriction of excessive authentication attempts
Medium
CVE-2026-43979
local-deep-research is Vulnerable to HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)
High
CVE-2026-7817
pgAdmin 4 contains local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities
High
CVE-2026-7816
pgAdmin 4: OS command injection vulnerability in Import/Export query export
High
CVE-2026-44971
GuardDog has a blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
High
CVE-2026-44340
PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.