Medium
CVE-2026-42303
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 430
Reset filters
Medium
CVE-2026-42080
PPTAgent: Arbitrary File Write via `save_generated_slides`
Medium
CVE-2026-42052
beets has a Cross-site Scripting vulnerability
Medium
CVE-2026-3219
pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files
High
CVE-2026-41490
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
High
CVE-2026-40474
wger has Broken Access Control in Global Gym Configuration Update Endpoint
Medium
CVE-2026-40353
wger has Stored XSS via Unescaped License Attribution Fields
Medium
CVE-2026-40320
Giskard has Unsandboxed Jinja2 Template Rendering in ConformityCheck
Medium
CVE-2026-40315
PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries
High
CVE-2026-40113
PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars
Medium
CVE-2026-40112
PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)
High
CVE-2026-34444
Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr
Medium
CVE-2026-26981
OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
High
CVE-2026-33752
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
High
CVE-2026-34937
PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution
Medium
CVE-2025-64340
FastMCP has a Command Injection vulnerability - Gemini CLI
Medium
CVE-2026-34400
alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API
High
CVE-2026-33980
Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries
High
CVE-2026-28788
Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
Medium
CVE-2026-33545
MobSF has SQL Injection in its SQLite Database Viewer Utils
Medium
CVE-2026-33140
Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution
High
CVE-2025-14287
MLflow has a command injection in mlflow/sagemaker/__init__.py
High
CVE-2026-32247
Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters
Medium
CVE-2026-25960
vLLM has SSRF Protection Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.