High
CVE-2026-43891
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,336
Reset filters
High
CVE-2026-42860
edx-enterprise has SSRF via SAML metadata URL in sync_provider_data endpoint
High
CVE-2026-42313
pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
Medium
CVE-2026-42312
pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
Critical
CVE-2026-44336
PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection
High
CVE-2026-41486
Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
Critical
CVE-2026-44551
Open WebUI has an LDAP Empty Password Authentication Bypass
Medium
ghsa-q9m2-fhv9-3jcf
`potato-annotation` has a Project-Boundary Bypass
High
ghsa-52cq-7v8r-62c6
gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense
High
ghsa-v7qw-hx66-4w9x
netbox-data-flows has stored XSS in ObjectAlias names rendered inside DataFlow tables
High
CVE-2026-44243
GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
High
CVE-2026-42284
GitPython: Unsafe option check validates multi_options before shlex.split transformation
High
CVE-2026-44503
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
Medium
CVE-2026-86256
wger: trainer_login open redirect - ?next= parameter not validated against host
Critical
CVE-2026-43948
wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
High
CVE-2026-86257
wger: CSV/TSV formula injection in gym member export (first_name/last_name)
High
CVE-2026-40110
Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`
High
CVE-2026-40934
Jupyter Server's Authentication Cookies Remain Valid After Password Reset and Server Restart
High
CVE-2026-35397
Jupyter Server: Path Traversal via incorrect startswith() root directory check allows access to sibling directories
Critical
CVE-2026-42048
Langflow Knowledge Bases API is Vulnerable to Path Traversal
High
CVE-2026-43001
OpenStack Keystone has an Incorrect Authorization Issue
Medium
CVE-2026-41016
apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider
Medium
CVE-2026-41481
LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass
Medium
CVE-2026-41425
Authlib: Cross-site request forging when using cache
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.