Medium
CVE-2026-54651
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-49851
Mistune: Potential DoS via quadratic-time parsing in parse_link_text
High
CVE-2026-54071
BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py
High
CVE-2026-49477
Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser
High
CVE-2026-49476
Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists
Medium
CVE-2026-44512
ONNX has Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)
High
CVE-2026-49471
Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE
Medium
CVE-2026-48737
pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs
Medium
CVE-2026-48987
pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager
High
CVE-2026-26193
Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages
Medium
CVE-2025-46571
Open WebUI allows limited stored XSS vila uploaded html file
High
CVE-2025-46719
Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions
Medium
CVE-2026-34225
Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality
High
CVE-2026-49825
`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes
Medium
CVE-2026-50127
Weblate SSRF: outbound URL guard misses some private ranges
High
CVE-2026-26192
Open WebUI vulnerable to Stored XSS via iFrame in citations model
Medium
CVE-2026-53533
aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address
Medium
CVE-2026-49452
WeasyPrint has CSS Injection via Presentational Hints
Low
CVE-2026-53759
Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases
High
CVE-2026-55426
Linuxfabrik Monitoring Plugins have local privilege escalation using embedded command
Low
CVE-2026-55630
Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)
Critical
CVE-2026-54769
Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent
High
CVE-2026-54771
Langroid: handle_message() executes user-supplied tool JSON without sender verification
Critical
CVE-2026-54760
Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.