High
CVE-2026-44660
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,861
Reset filters
Medium
CVE-2026-44681
Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect
High
CVE-2026-44345
BentoML Dockerfile command injection via docker.base_image (sister of pending GHSA-w2pm-x38x-jp44 / CVE-2026-33744 / CVE-2026-35043)
High
CVE-2026-44346
Dockerfile command injection via envs[*].name in bentofile.yaml (sibling fix-bypass of CVE-2026-33744 and CVE-2026-35043)
Medium
CVE-2026-44353
Streamlink has an arbitrary local file read via file:// URI in HLS and DASH
Medium
CVE-2026-48545
Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across
Medium
CVE-2026-47104
libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB
Medium
CVE-2026-23679
libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface clai
High
CVE-2026-49014
In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer witho
Medium
CVE-2026-44899
Mistune Image Directive CSS Injection Vulnerability
Medium
CVE-2026-44898
Mistune TOC Anchor Injection XSS
Medium
CVE-2026-44897
Mistune Heading ID Attribute has Injection XSS
Medium
CVE-2026-44896
Mistune has XSS via unescaped figclass/figwidth in Figure directive
Medium
CVE-2026-44708
Mistune Math Plugin has an XSS Escape Bypass
High
CVE-2026-44730
OpenCTI: Privilege escalation via graphQL API is abusable by organization admins, due to incorrect ACL on userEdit relationAdd
High
CVE-2026-45361
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attack
Critical
CVE-2026-2651
MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled
High
CVE-2026-4372
HuggingFace transformers vulnerable to remote code execution
Medium
ghsa-ggxf-37hm-9wqf
instagrapi: Unsafe signup challenge path handling in instagrapi
Medium
CVE-2026-40864
JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)
Medium
Exploited in attacks
CVE-2026-48710
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Critical
CVE-2026-46703
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
Critical
CVE-2026-46695
BoxLite: Permission Bypass Allows Modification of Read-Only Files
Medium
CVE-2026-46678
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.