High
CVE-2026-107230
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-61443
PraisonAI: SkillTools Executes Scripts Without Path Containment Validation
High
CVE-2026-61437
PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow
Medium
CVE-2026-61432
PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace
Medium
CVE-2026-107290
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
Low
CVE-2026-107291
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
CVE-2026-107289
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
High
CVE-2026-61446
PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification
Critical
CVE-2026-61447
PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets
Medium
CVE-2026-60087
PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments
High
CVE-2026-61430
PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure
Medium
CVE-2026-60089
PraisonAI: Project config can auto-save agent output outside the project root
Low
CVE-2026-107283
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
Medium
CVE-2026-107285
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
Medium
CVE-2026-107280
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
Critical
CVE-2026-107282
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
High
CVE-2026-107231
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
Low
CVE-2026-94258
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery 3.6.4 - 4.0.0 - Authenticated (Administrator+) Information Exposure
Medium
CVE-2026-105198
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.7.3 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-105076
Vitepos – Point of Sale (POS) for WooCommerce <= 3.6.1 - Authenticated (Custom Role+) SQL Injection
Medium
CVE-2026-105893
Event Tickets and Registration <= 5.30.0.1 - Missing Authorization
Medium
CVE-2026-62128
Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.21 - Missing Authorization
Medium
CVE-2026-94275
Track Orders for WooCommerce – Multi Carrier WooCommerce Shipping < 1.2.7 - Unauthenticated Information Exposure
Medium
CVE-2026-106600
GiveWP – Donation Plugin and Fundraising Platform <= 4.18.0 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.