Critical
CVE-2026-68770
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 696
Reset filters
High
CVE-2026-87996
Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
High
CVE-2026-102831
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
Unrated
CVE-2026-100841
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MON
Unrated
CVE-2026-100653
vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to
Critical
CVE-2026-61732
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Medium
CVE-2026-77528
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
High
ghsa-39wr-7q6h-cf68
LMDeploy has an SSRF bypass
High
ghsa-xjw9-38cr-6372
djust: A template binding inherits a context safety grant it never earned (XSS)
High
ghsa-9395-2g46-rj3f
djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)
Medium
CVE-2026-73555
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
Medium
CVE-2026-73557
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
Medium
CVE-2026-84305
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
Medium
CVE-2026-84311
pypdf: Possible long runtimes/large memory usage when extracting XForm objects
Medium
CVE-2026-81723
NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`
High
CVE-2026-55509
WsgiDAV MySQL provider has a blind SQL injection
High
CVE-2026-55520
Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching
High
CVE-2026-54757
Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
Medium
CVE-2026-55618
eml_parser has a URL extraction bypass via HTML entities in URLs
High
CVE-2026-55539
PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete
High
CVE-2026-55526
praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
High
CVE-2026-55538
PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated
Critical
CVE-2026-61539
Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing
High
CVE-2026-72818
NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.