Medium
ghsa-9mqm-qcwf-5qhg
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,016
Reset filters
Medium
CVE-2026-73497
MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)
High
ghsa-52vm-mxx8-f227
Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths
Medium
ghsa-mxwc-wh95-pw4g
Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler
High
CVE-2026-59939
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
Medium
CVE-2026-58501
Zeep: Server-Side Request Forgery (SSRF)
High
CVE-2026-59925
Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
Medium
CVE-2026-59929
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
High
CVE-2026-59922
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
Medium
ghsa-f66q-9rf6-8795
Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion
Medium
ghsa-q855-8rh5-jfgq
ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path
Unrated
pysec-2026-1074
Malicious code in ray-mcp-server (PyPI)
High
CVE-2026-40036
Unfurl's unbounded zlib decompression allows decompression bomb DoS
High
CVE-2026-1117
Lollms has an Improper Access Control vulnerability
High
CVE-2026-24779
vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector
Low
CVE-2026-24408
sigstore CSRF possibility in OIDC authentication during signing
Medium
CVE-2026-24489
Gakido vulnerable to HTTP Header Injection (CRLF Injection)
High
CVE-2026-24780
AutoGPT is Vulnerable to RCE via Disabled Block Execution
Medium
CVE-2026-23877
Swing Music has a Directory Traversal & Filesystem can be accessed by a non-admin user
High
CVE-2026-23490
pyasn1 has a DoS vulnerability in decoder
High
CVE-2026-23842
ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion
High
CVE-2026-22219
Chainlit contain a server-side request forgery (SSRF) vulnerability
Medium
CVE-2026-23968
Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false
High
CVE-2026-22807
vLLM affected by RCE via auto_map dynamic module loading during model initialization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.