Medium
CVE-2026-32112
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 733
Reset filters
Medium
CVE-2026-32111
ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle
Medium
CVE-2026-31815
django-unicorn affected by component state manipulation via unvalidated attribute access
High
CVE-2026-27905
BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction
Medium
CVE-2026-27794
LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution
Medium
CVE-2026-25734
Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata
Medium
CVE-2026-25736
Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute
Medium
CVE-2026-27469
Isso affected by Stored XSS via comment website field
High
CVE-2026-25733
Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function
High
CVE-2026-25136
Rucio WebUI has a Reflected Cross-site Scripting Vulnerability
Medium
CVE-2026-25735
Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name
High
CVE-2026-53875
Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER
High
CVE-2026-1669
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
Low
CVE-2026-26013
LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
High
CVE-2026-1707
pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability
Medium
ghsa-9mqm-qcwf-5qhg
CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources
Medium
ghsa-mxwc-wh95-pw4g
Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler
High
CVE-2026-59939
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
High
CVE-2026-59925
Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
Medium
CVE-2026-59929
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
High
CVE-2026-59922
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
High
CVE-2026-53874
picklescan missing detection by simple obfuscation of a `builtins.eval` call
High
CVE-2026-1777
SageMaker Python SDK has Exposed HMAC
Unrated
pysec-2026-1075
Malicious code in tiktoken-mcp (PyPI)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.