High
CVE-2026-84452
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 456
Reset filters
Medium
CVE-2026-73560
vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections
Medium
CVE-2026-73555
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
Critical
CVE-2026-71428
unstructured: Server-Side Request Forgery in the URL-based partitioning
Medium
CVE-2026-81723
NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`
High
CVE-2026-62677
Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE
High
CVE-2026-54757
Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
High
CVE-2026-55585
qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`
Medium
CVE-2026-55619
eml_parser has parser DoS via deeply nested parentheses in e-mail headers
High
CVE-2026-55620
eml_parser vulnerable to DoS via deeply nested parens in Received headers
Medium
CVE-2026-55618
eml_parser has a URL extraction bypass via HTML entities in URLs
Critical
CVE-2026-55546
qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input
High
CVE-2026-55540
PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks
High
CVE-2026-55541
PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
Critical
CVE-2026-53710
mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
High
CVE-2026-55525
praisonaiagents web_crawl vulnerable to SSRF via redirect-following
Medium
CVE-2026-12570
Keras model loading is vulnerable to denial of service through HDF5 shape bombs
High
CVE-2026-53951
Copier has a trust-prefix bypass via path traversal that runs tasks unprompted
Medium
CVE-2026-69112
Accelerate path traversal and denial of service via sharded checkpoint weight_map entries
High
CVE-2026-67322
GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
High
CVE-2026-67323
GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`
High
CVE-2026-87819
GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing
High
CVE-2026-87817
GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution
Medium
ghsa-73p9-6hrp-8qhr
AIIR verification and policy gates could report success without enforcing the control (fail-open)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.