High
ghsa-vwf3-4xxj-qg6h
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,999
Reset filters
Critical
CVE-2026-79675
NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)
High
CVE-2026-79676
NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement
High
ghsa-8cp3-qxj6-px34
utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion
Medium
CVE-2026-12210
utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins
High
ghsa-9qhg-99ww-9mqc
utcp-http SSRF: HTTP tool invocation follows redirects without re-validating the target
High
CVE-2026-55522
PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code
Critical
CVE-2026-79657
NLTK: Allowlisted pickle loaders still permit code execution in current source
Critical
CVE-2026-78676
GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE
High
CVE-2026-78677
GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
Medium
CVE-2026-78678
GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()
High
CVE-2026-78682
NLTK: pathsec SSRF protection can be bypassed when a proxy is configured
High
CVE-2026-78675
GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)
High
CVE-2026-70626
NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root
High
CVE-2026-63312
NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read
Medium
CVE-2026-65915
NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol
High
CVE-2026-62385
NLTK: Stable FrameNet and NKJP readers parse outside-root XML
Low
ghsa-92hv-j533-69wc
Wagtail: Identification of documents by SHA1 hash
Medium
CVE-2026-76239
stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address
High
CVE-2026-55253
LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
Medium
CVE-2026-102734
asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
High
ghsa-p77j-g7h5-r2vw
GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)
High
CVE-2026-76222
GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
High
CVE-2026-71308
Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.