Medium
CVE-2026-44219
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 733
Reset filters
High
CVE-2026-33079
Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input
Medium
CVE-2026-43901
wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured
High
CVE-2026-42079
PPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in Scope
Medium
CVE-2026-42078
PPTAgent: Arbitrary File Write + Directory Creation via markdown_table_to_image
Medium
CVE-2026-42052
beets has a Cross-site Scripting vulnerability
Medium
CVE-2026-40353
wger has Stored XSS via Unescaped License Attribution Fields
High
CVE-2026-40114
PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API
High
CVE-2026-40116
PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits
Medium
CVE-2026-40112
PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)
Medium
CVE-2026-22680
OpenViking contains a missing authorization vulnerability in the task polling endpoints
Medium
CVE-2026-39413
lightrag-hku: JWT Algorithm Confusion Vulnerability
High
CVE-2026-39306
PraisonAI recipe registry pull path traversal writes files outside the chosen output directory
High
CVE-2026-39307
PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction
High
CVE-2026-35464
pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)
High
CVE-2026-40072
web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling
High
CVE-2026-34172
Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment
Low
CVE-2026-33045
Home Assistant has stored XSS in history-graphs
Low
CVE-2026-33044
Home Assistant has stored XSS in Map-card through malicious device name
High
CVE-2026-28788
Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
Medium
CVE-2026-33545
MobSF has SQL Injection in its SQLite Database Viewer Utils
Medium
CVE-2026-33140
Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution
Medium
CVE-2026-32889
Denial of service via non-terminating SYLT frame parsing loop in tinytag
High
CVE-2026-33155
DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.