Critical
CVE-2026-78676
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,333
Reset filters
High
CVE-2026-78677
GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
High
CVE-2026-78682
NLTK: pathsec SSRF protection can be bypassed when a proxy is configured
High
CVE-2026-78675
GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)
High
CVE-2026-70626
NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root
High
CVE-2026-63312
NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read
Medium
CVE-2026-65915
NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol
Medium
CVE-2026-63311
NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure
Medium
CVE-2026-62383
NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely
Medium
CVE-2026-76239
stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address
High
CVE-2026-76222
GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
High
CVE-2026-71417
Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it
Medium
CVE-2026-71317
Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority
High
CVE-2026-71308
Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates
Medium
CVE-2026-70667
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)
Medium
CVE-2026-73974
linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)
High
CVE-2026-70666
Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
Critical
Exploited in attacks
CVE-2026-64849
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
Medium
CVE-2026-68922
MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads
Critical
CVE-2026-55209
resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read
High
CVE-2026-59893
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
Medium
CVE-2026-68923
MobSF's CSRF checks not enforced after Django migration
Medium
CVE-2026-68520
Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
Medium
CVE-2026-73559
vLLM: Completion prompt lists fan out into unbounded engine requests
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.