High
CVE-2026-59152
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,358
Reset filters
Medium
CVE-2026-58266
Anki: User scripts in iframes have access to the internal Anki API
Medium
CVE-2026-58198
ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer
High
CVE-2026-58499
EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id
High
CVE-2026-76238
stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)
High
CVE-2026-76237
stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)
High
CVE-2026-76236
stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)
Critical
CVE-2026-55447
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
High
ghsa-rpj2-4hq8-938g
VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files
High
ghsa-p5wc-9w9r-m232
Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser
High
ghsa-8823-qg2x-pv9f
Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit
High
CVE-2026-54527
jupyterlab-git extension: Stored XSS leading to RCE
High
CVE-2026-66065
ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys
Medium
CVE-2026-67338
JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol
High
CVE-2026-57586
agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
Medium
CVE-2026-58653
praisonai-platform: Authorization Bypass Through User-Controlled Key
Critical
CVE-2026-47103
python-statemachine SCXML <data expr> Eval Injection
Critical
CVE-2026-57125
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
High
CVE-2026-57112
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
Medium
CVE-2026-48817
Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
High
CVE-2026-48818
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
Critical
CVE-2026-50203
Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory
Medium
CVE-2026-48776
LangGraph SDK has unsafe URL path construction
High
ghsa-69qj-pvh9-c5wg
yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.