Medium
CVE-2026-50019
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-50574
yt-dlp: Arbitrary code execution via manifest downloads with aria2c
Medium
CVE-2026-54006
Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar
Medium
CVE-2026-46448
OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints
Medium
CVE-2026-54236
vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
Low
CVE-2026-53537
python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
Low
CVE-2026-53540
python-multipart: Negative Content-Length in parse_form buffers the entire body in memory
High
CVE-2026-53539
python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
Low
CVE-2026-53538
python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
High
CVE-2026-49855
tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)
Low
CVE-2026-49854
Tornado has out-of-bounds memory access via C extension
Medium
CVE-2026-48735
pypdf: Manipulated XMP metadata streams can exhaust RAM
Medium
CVE-2026-49460
pypdf: Inefficient decoding of FlateDecode PNG predictor streams
Medium
CVE-2026-54530
pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction
Medium
CVE-2026-49461
pypdf: Possible large memory usage for form XObjects during text extraction
Medium
CVE-2026-54531
pypdf: Possible infinite loop when processing outlines/bookmarks in writer
High
CVE-2026-49853
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
High
CVE-2026-12398
Galaxy NG: command injection vulnerability
Medium
CVE-2026-42867
Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint
High
CVE-2026-48099
WsgiDAV encoded dot segments can escape filesystem share roots
Medium
CVE-2026-48045
python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood
Medium
CVE-2026-48155
pypdf: Possible large memory usage for large offsets for layout mode text
Medium
CVE-2026-48156
pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams
High
CVE-2026-47781
PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.