Low
CVE-2026-24130
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,016
Reset filters
Medium
CVE-2026-23986
Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true
High
CVE-2025-68616
WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect
High
CVE-2025-14279
MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation
Low
CVE-2026-21889
Weblate leaks information via screenshots
Medium
CVE-2026-22779
BlackSheep's ClientSession is vulnerable to CRLF injection
High
CVE-2026-22033
Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field
High
CVE-2026-23535
Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command
Medium
CVE-2026-22251
Weblate wlc has insecure API key configuration
Medium
CVE-2026-21860
Werkzeug safe_join() allows Windows special device names with compound extensions
Medium
CVE-2026-21874
NiceGUI has Redis connection leak via tab storage causes service degradation
High
CVE-2026-21441
Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
High
CVE-2026-53872
picklescan has Arbitrary file read using `io.FileIO`
Medium
CVE-2026-21892
Parsl Monitoring Visualization Vulnerable to SQL Injection
Medium
CVE-2026-21883
Bokeh server applications have Incomplete Origin Validation in WebSockets
Medium
CVE-2025-69229
AIOHTTP vulnerable to DoS through chunked messages
Medium
CVE-2025-69228
AIOHTTP vulnerable to denial of service through large payloads
High
CVE-2025-71321
Picklescan vulnerable to Arbitrary File Writing
Medium
CVE-2025-67743
Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service
High
CVE-2025-69223
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
High
CVE-2025-68279
Weblate has an arbitrary file read via symbolic links
Medium
CVE-2025-34469
Cowrie has a SSRF vulnerability in wget/curl emulation enabling DDoS amplification
Medium
CVE-2025-68481
FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO
Medium
CVE-2025-68145
mcp-server-git has missing path validation when using --repository flag
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.