Critical
CVE-2026-31237
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Critical
CVE-2026-31239
mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub
Critical
CVE-2026-31238
Ludwig framework is vulnerable to insecure deserialization in its model serving component
Critical
CVE-2026-31234
Horovod contains an insecure deserialization vulnerability in its KVStore HTTP server component
High
CVE-2026-31221
PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization
High
CVE-2026-41284
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
Low
CVE-2026-43514
Apache Tomcat - AJP secret compared in non-constant time
Critical
CVE-2026-43512
Apache Tomcat - Digest authenticator will authenticate any unknown user
High
CVE-2026-43513
Apache Tomcat: LockOutRealm treats user names as case-sensitive
Critical
CVE-2026-43515
Apache Tomcat - Security constraints not correctly applied
High
CVE-2026-42498
Apache Tomcat - WebSocket authentication header exposure
Critical
CVE-2026-41293
Apache Tomcat - HTTP/2 request headers not validated
Critical
CVE-2026-31220
PySyft server-side arbitrary Python execution after code approval
Critical
CVE-2025-65719
Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page
High
CVE-2026-43891
changedetection.io has an Arbitrary Local File Read via a crafted backup restore
High
CVE-2026-41895
changedetection.io project has an XXE vulnerability
Medium
CVE-2026-6965
Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter
High
CVE-2026-6929
JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter
Medium
CVE-2025-14033
ilGhera Support System for WooCommerce <= 1.3.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Critical
CVE-2026-42074
OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input
Medium
CVE-2026-6962
Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-7619
Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter
Medium
CVE-2025-9988
Broadstreet <= 1.53.1 - Missing Authorization to Authenticated (Subscriber+) Advertiser Creation
Medium
CVE-2026-42073
OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.