Medium
CVE-2026-45409
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,336
Reset filters
Critical
CVE-2026-47731
NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)
Medium
CVE-2026-47706
Strawberry GraphQL has a Circular Fragment Reference DOS
Critical
CVE-2026-44182
Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering
Critical
CVE-2026-44181
Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution
Critical
CVE-2026-44180
Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass
Low
CVE-2026-7666
Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake
Medium
CVE-2026-3198
MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions
Medium
CVE-2026-8643
pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory
Critical
CVE-2026-47413
praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members
Medium
CVE-2026-49267
Apache Airflow has no certificate validation on SMTP STARTTLS connections
High
CVE-2026-49298
Apache Airflow: Execution API JWT leaked via KubernetesExecutor worker command-line args
Low
CVE-2026-45426
Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against D
High
CVE-2026-41084
A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances`) evaluated authorization against the `dag_id` resolved from the URL path whil
Critical
CVE-2026-47416
praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}
Critical
CVE-2026-47410
praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset
Critical
CVE-2026-47407
PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation
Critical
CVE-2026-47391
PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
Medium
CVE-2026-47395
PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
Critical
CVE-2026-47396
PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset
Medium
CVE-2026-47390
PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
Medium
CVE-2026-114109
uv is vulnerable to arbitrary file write through entry point names
Medium
ghsa-qp9x-wp8f-qgjj
tuf has platform-dependent delegation path matching
Medium
CVE-2026-42999
OpenStack Keystone has an Authorization Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.