Low
CVE-2026-35402
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-40602
Home Assistant Command-line Interface: Handling of user-supplied Jinja2 templates
High
CVE-2026-40474
wger has Broken Access Control in Global Gym Configuration Update Endpoint
Medium
CVE-2026-40353
wger has Stored XSS via Unescaped License Attribution Fields
Medium
CVE-2026-40347
python-multipart affected by Denial of Service via large multipart preamble or epilogue data
Critical
CVE-2026-54334
UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen
Critical
CVE-2026-54333
UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable
Medium
CVE-2026-41206
PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code
Medium
CVE-2026-40260
pypdf: Manipulated XMP metadata entity declarations can exhaust RAM
Medium
CVE-2026-41168
pypdf has long runtimes for wrong size values in cross-reference and object streams
Low
CVE-2026-40319
Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check
Medium
CVE-2026-40320
Giskard has Unsandboxed Jinja2 Template Rendering in ConformityCheck
High
CVE-2026-41133
pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)
High
CVE-2026-40683
OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean
High
CVE-2026-1462
Keras has an untrusted deserialization vulnerability
Medium
CVE-2026-6110
MetaGPT has an eval injection in metagpt/strategy/tot.py
Low
CVE-2026-6111
MetaGPT affected by server-side request forgery in metagpt/utils/common.py
Low
CVE-2026-6109
MetaGPT has an eval injection via a cross-site request forgery attack
Medium
CVE-2026-40178
ajenti.plugin.core has race conditions in 2FA
Medium
CVE-2026-40315
PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries
High
CVE-2026-40162
Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble
Medium
CVE-2026-40159
PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution
High
CVE-2026-40114
PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API
High
CVE-2026-40160
PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.