High
CVE-2026-45134
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,861
Reset filters
Medium
CVE-2026-44223
vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters
Critical
CVE-2026-31236
llm CLI tool contains a code injection vulnerability via `--functions` command-line argument
Critical
CVE-2026-31235
imgaug contains an insecure deserialization vulnerability in BackgroundAugmenter class within multicore.py module
Critical
CVE-2026-31237
Ludwig framework is vulnerable to insecure deserialization through its predict() method.
Critical
CVE-2026-31239
mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub
Critical
CVE-2026-31238
Ludwig framework is vulnerable to insecure deserialization in its model serving component
Critical
CVE-2026-31234
Horovod contains an insecure deserialization vulnerability in its KVStore HTTP server component
High
CVE-2026-31221
PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization
Critical
CVE-2026-31220
PySyft server-side arbitrary Python execution after code approval
Critical
CVE-2025-65719
Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page
High
CVE-2026-43891
changedetection.io has an Arbitrary Local File Read via a crafted backup restore
High
CVE-2026-41895
changedetection.io project has an XXE vulnerability
High
CVE-2026-2614
MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem
High
CVE-2026-2393
A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/server/handlers.py` accepts a user-controlled `url` parameter w
High
CVE-2026-42860
edx-enterprise has SSRF via SAML metadata URL in sync_provider_data endpoint
High
CVE-2026-42315
PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data
Medium
CVE-2026-42314
PyLoad Vulnerable to Path Traversal via Package Folder Name
High
CVE-2026-42313
pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
Medium
CVE-2026-42312
pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
Medium
CVE-2026-44201
Wagtail has improper restriction handling on Documents and Images API
Medium
CVE-2026-44200
Wagtail has improper permission handling when copying pages
Medium
CVE-2026-44199
Wagtail has improper permission handling when deleting form submissions
Medium
CVE-2026-44198
Wagtail has improper permission handling when viewing page history
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.