Critical
CVE-2024-5986
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,016
Reset filters
Critical
CVE-2026-40035
Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)
Medium
ghsa-gpx9-96j6-pp87
TaskWeaver has Protection Mechanism Failure and Server-Side Request Forgery (SSRF)
Medium
CVE-2026-22218
Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value,
Medium
CVE-2026-23528
Dask Distributed is Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard
High
CVE-2025-68472
MindsDB has improper sanitation of filepath that leads to information disclosure and DOS
Medium
CVE-2026-22773
vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions
Medium
CVE-2025-61782
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authen
High
CVE-2026-21445
Langflow Missing Authentication on Critical API Endpoints
High
CVE-2025-68478
External Control of File Name or Path in Langflow
High
CVE-2025-63387
Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials o
Medium
CVE-2024-29370
In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an excepti
Critical
CVE-2025-67895
Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context
Medium
CVE-2025-68113
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
Medium
CVE-2025-66407
Weblate has a Server-Side Request Forgery issue
High
CVE-2025-67726
Tornado: Quadratic DoS via Crafted Multipart Parameters
High
CVE-2025-67725
Tornado: Quadratic DoS via Repeated Header Coalescing
Critical
CVE-2025-67511
Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool
High
CVE-2025-60455
Modular Max Serve has Unsafe Deserialization vulnerability
Critical
CVE-2025-12762
pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode
High
CVE-2025-64496
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
High
CVE-2025-64495
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Medium
CVE-2025-54941
Apache Airflow has a command injection vulnerability in "example_dag_decorator"
Medium
CVE-2025-62402
Apache Airflow `/api/v2/dagReports` executes DAG Python in API
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.