Critical
CVE-2024-11958
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,358
Reset filters
Critical
CVE-2025-43859
h11 accepts some malformed Chunked-Encoding bodies
Critical
CVE-2025-27520
BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
Critical
CVE-2024-9052
vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object
Critical
CVE-2022-46741
PaddlePaddle Out-of-bounds Read vulnerability
Critical
CVE-2024-8769
Aim path traversal in LockManager.release_locks
Critical
CVE-2021-21386
Improper Neutralization of Argument Delimiters in a Decompiling Package Process in APKLeaks
Critical
CVE-2026-49257
mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind
Medium
ghsa-75mw-h36v-2jv7
Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers
Critical
ghsa-98x5-vq43-vc5p
semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin
Medium
ghsa-m8j6-rc5x-wv36
nono-py's policy JSON accepts unknown security fields
Medium
ghsa-9j7f-3r4p-pwh6
nono-py vulnerable to authorization bypass / policy confusion
Critical
CVE-2026-48797
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
Medium
ghsa-72w7-mf9g-733p
nono-py has proxy-only network fallback bypass on older Linux kernels
Medium
CVE-2026-48782
pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)
Unrated
pysec-2026-236
Malicious code in pyphetools (PyPI)
High
CVE-2026-47214
Docling: Unsafe URI and Path Handling in HTML Backend
Medium
CVE-2026-44018
Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
Unrated
pysec-2026-235
Malicious code in ppkt2synergy (PyPI)
Unrated
pysec-2026-234
Malicious code in phenopacket-store-toolkit (PyPI)
High
CVE-2026-49486
The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was trans
Critical
CVE-2026-55166
Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise
Medium
CVE-2026-77088
justhtml: to_markdown() code-span blank-line breakout enables XSS
Unrated
pysec-2026-233
Malicious code in gpsea (PyPI)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.