High
CVE-2026-54653
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 696
Reset filters
High
CVE-2026-55404
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
Medium
CVE-2026-59217
Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)
Medium
CVE-2026-59220
Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config
High
CVE-2026-59936
pypdf: Possible infinite loop for not terminated inline images
High
CVE-2026-59935
pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
Medium
CVE-2026-59820
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
High
CVE-2026-54058
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
Medium
CVE-2026-59198
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
High
CVE-2026-54549
meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch
High
CVE-2026-54547
meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
High
CVE-2026-54567
Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)
High
CVE-2026-54234
vLLM has Remote DoS via Invalid Recovered Token Reinjection
High
CVE-2026-50271
dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
High
CVE-2026-54446
NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode
High
CVE-2026-54447
garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store
High
CVE-2026-57130
PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
High
CVE-2026-57122
PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)
Critical
CVE-2026-57116
PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation
High
CVE-2026-57126
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
Medium
CVE-2026-57115
PraisonAI: SpiderTools redirect-target SSRF protection bypass
High
CVE-2026-56834
PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
High
CVE-2026-59884
pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
Medium
CVE-2026-59203
Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.