Low
CVE-2026-10803
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,861
Reset filters
Low
CVE-2026-10783
A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache Key Handler. Performing a manipulation results in use of wea
Critical
CVE-2026-44182
Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering
Critical
CVE-2026-44181
Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution
Critical
CVE-2026-44180
Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass
Medium
CVE-2026-44546
daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \
Low
CVE-2026-35193
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
High
CVE-2026-44545
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote at
Low
CVE-2026-8404
Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling
Low
CVE-2026-7666
Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake
Low
CVE-2026-6873
Django: signed cookies are vulnerable to salt namespace collisions
High
CVE-2026-5241
huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path
Low
CVE-2026-48587
Django: has_vary_header may expose cached responses when Vary values contain whitespace
High
CVE-2026-4035
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environme
Medium
CVE-2026-35212
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Versions prior to 7.260227.0 are vulnerable to XSS in the rendering of email-message observable bod
Medium
CVE-2026-47265
AIOHTTP is vulnerable to cross-origin redirect with per-request cookies
Medium
CVE-2026-34993
AIOHTTP is Vulnerable to Deserialization of Untrusted Data
High
CVE-2026-3514
Prefect has an Authentication Middleware Bypass when URL paths are appended with 'health' or 'ready'
Medium
CVE-2026-3198
MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions
Medium
CVE-2026-8643
pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory
Critical
CVE-2026-47413
praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members
Medium
CVE-2026-49267
Apache Airflow has no certificate validation on SMTP STARTTLS connections
High
CVE-2026-49298
Apache Airflow: Execution API JWT leaked via KubernetesExecutor worker command-line args
Medium
CVE-2026-46764
Apache Airflow has an Authorization Bypass Through User-Controlled Key
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.