Medium
Exploited in attacks
CVE-2026-48710
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,358
Reset filters
Critical
CVE-2026-46703
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
Critical
CVE-2026-46695
BoxLite: Permission Bypass Allows Modification of Read-Only Files
Medium
CVE-2026-46678
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)
Medium
CVE-2026-2734
MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks
High
ghsa-mw8f-w6p8-xrf4
wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None
Medium
CVE-2026-42526
In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_t
Critical
CVE-2026-31072
APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization
Critical
CVE-2026-45568
rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths
Critical
ghsa-wx9m-wx4f-4cmg
Malicious dropper in mistralai 2.4.6 PyPI package
Medium
ghsa-74r7-3mjm-jc5v
eduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check
Critical
CVE-2026-7301
SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket
High
CVE-2026-2652
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and
High
CVE-2026-56398
Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
Medium
ghsa-g39v-cvjh-8fpf
Home Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/
High
CVE-2026-44513
Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components
Medium
CVE-2026-44439
Playwright Capture permits access to local files and internal network resources during page capture
High
CVE-2026-42304
Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
High
CVE-2026-44432
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
High
CVE-2026-42266
JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
Medium
CVE-2026-86255
wger has an Uncontrolled Resource Consumption issue
High
CVE-2026-45134
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
Medium
CVE-2026-44223
vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters
Critical
CVE-2026-31236
llm CLI tool contains a code injection vulnerability via `--functions` command-line argument
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.