Unrated
CVE-2026-100650
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 738
Reset filters
Critical
CVE-2026-61732
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Medium
CVE-2026-77528
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
High
CVE-2026-61570
MPXJ: XXE Vulnerability in MerlinReader
High
CVE-2026-84452
Windows ML CLI: CORS misconfig enables localhost RCE
Medium
CVE-2026-88000
Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree
Medium
CVE-2026-88002
Open WebUI: Any authenticated user can hang the server via a cyclic chat message history
Medium
CVE-2026-50024
GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server
Medium
CVE-2026-84379
HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
Medium
CVE-2026-71486
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
Medium
CVE-2026-73557
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
Medium
CVE-2026-84305
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
Medium
CVE-2026-81723
NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`
Medium
CVE-2026-12876
NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars
High
CVE-2026-76098
Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
High
CVE-2026-62676
Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
High
CVE-2026-78680
NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary
Medium
CVE-2026-73228
Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`
High
CVE-2026-55485
piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
Critical
CVE-2026-54569
senaite.core Vulnerable to Eval Injection and Missing Authorization
High
CVE-2026-54591
asyncssh has SCP Path Traversal to Arbitrary File Write
High
CVE-2026-54757
Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
High
CVE-2026-55099
icalendar has Algorithmic Complexity in Equality
Critical
CVE-2026-55640
nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.