High
CVE-2026-57171
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 456
Reset filters
High
CVE-2026-57170
Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
Medium
CVE-2026-91129
Home Assistant: mDNS Server-Side Request Forgery
High
CVE-2026-77267
mcp-atlassian has an incomplete SSRF remediation
High
CVE-2026-77247
MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters
High
CVE-2026-77251
MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)
High
CVE-2026-59991
psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry
High
CVE-2026-77246
MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path
Medium
CVE-2026-86000
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns
Medium
CVE-2026-85999
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)
High
CVE-2026-33625
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
Medium
CVE-2026-64847
AnyIO process-pool workers can block indefinitely on undrained stderr
Medium
CVE-2026-85078
sanic chunked trailer request smuggling allows hidden second request execution
Critical
CVE-2025-59953
LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy
Critical
CVE-2026-56315
PickleScan has multiple stdlib modules with direct RCE not in blocklist
Medium
CVE-2026-102830
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
Medium
CVE-2026-102904
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs
High
CVE-2026-102930
Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
High
CVE-2026-103262
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
High
CVE-2026-103263
Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
High
CVE-2026-100845
MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files
High
CVE-2026-100843
Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch
Unrated
CVE-2026-100841
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MON
Critical
CVE-2026-61732
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.