High
CVE-2026-34544
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,341
Reset filters
High
CVE-2026-40072
web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling
High
CVE-2026-30762
LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass
High
CVE-2026-35187
pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter
High
CVE-2026-34954
PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL
High
CVE-2026-34936
PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback
Medium
CVE-2026-34939
PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()
Medium
CVE-2025-64340
FastMCP has a Command Injection vulnerability - Gemini CLI
High
CVE-2026-34172
Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment
Low
CVE-2026-29071
Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories
Low
CVE-2026-33045
Home Assistant has stored XSS in history-graphs
Low
CVE-2026-33044
Home Assistant has stored XSS in Map-card through malicious device name
High
CVE-2026-33509
pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration
High
CVE-2026-28788
Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
Medium
CVE-2026-33545
MobSF has SQL Injection in its SQLite Database Viewer Utils
High
CVE-2025-15031
Arbitrary file write via tar traversal in mlflow
High
CVE-2026-33139
PySpector has a Plugin Sandbox Bypass leads to Arbitrary Code Execution
Medium
CVE-2026-32889
Denial of service via non-terminating SYLT frame parsing loop in tinytag
High
CVE-2026-33155
DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT
Medium
CVE-2026-4269
Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit
Medium
CVE-2026-32111
ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle
High
CVE-2025-69196
FastMCP OAuth Proxy token reuse across MCP servers
Medium
CVE-2026-31815
django-unicorn affected by component state manipulation via unvalidated attribute access
Medium
CVE-2026-29787
mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.