High
CVE-2026-33010
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,341
Reset filters
High
CVE-2026-27826
MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers
Low
CVE-2026-25674
Django has a Race Condition vulnerability
Low
CVE-2026-29790
dbt-common's commonprefix() doesn't protect against path traversal
High
CVE-2026-27905
BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction
Medium
CVE-2026-27839
wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup
High
CVE-2026-27622
OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write
Medium
CVE-2026-25138
Rucio WebUI has Username Enumeration via Login Error Message
High
CVE-2026-1669
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
Medium
CVE-2026-26057
Skill-scanner Unsecured Network Binding Vulnerability
High
ghsa-h4g2-xfmw-q2c9
Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset
Medium
ghsa-9mqm-qcwf-5qhg
CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources
Medium
CVE-2026-73497
MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)
High
ghsa-52vm-mxx8-f227
Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths
Medium
ghsa-mxwc-wh95-pw4g
Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler
High
CVE-2026-59939
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
Medium
CVE-2026-58501
Zeep: Server-Side Request Forgery (SSRF)
Medium
CVE-2026-59930
Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content
High
CVE-2026-59925
Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
Medium
CVE-2026-59929
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
Medium
CVE-2026-59890
setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
Medium
CVE-2026-59923
Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
High
CVE-2026-59922
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
Low
CVE-2026-14966
BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.