High
CVE-2026-8086
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,861
Reset filters
Medium
CVE-2026-8084
A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the component HDF-EOS Grid File Handler. This
High
CVE-2026-44244
GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
High
CVE-2026-44243
GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
High
CVE-2026-42215
GitPython has Command Injection via Git options bypass
High
CVE-2026-42284
GitPython: Unsafe option check validates multi_options before shlex.split transformation
Medium
CVE-2026-44263
Weblate Vulnerable to Private Translation Enumeration via Screenshot API
Medium
CVE-2026-44264
Weblate vulnerable to XSS via crafted Markdown
Medium
CVE-2026-41654
Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
Medium
CVE-2026-41519
Weblate Doesn't Invalidate API Token on Password Change
High
CVE-2026-44503
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
Critical
CVE-2026-44484
Compromise of PyTorch Lightning PyPi Package Versions
Medium
ghsa-7f4h-6264-89fr
axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
High
CVE-2026-0897
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (D
Critical
CVE-2026-44364
misp-modules website - Missing CSRF protection in the website home blueprint
Low
ghsa-7mw3-79jq-xc7f
aiograpi has dependency on vulnerable orjson 3.11.4 (CVE-2025-67221)
Medium
CVE-2026-86256
wger: trainer_login open redirect - ?next= parameter not validated against host
Critical
CVE-2026-43948
wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
High
CVE-2026-86257
wger: CSV/TSV formula injection in gym member export (first_name/last_name)
Critical
CVE-2026-29090
Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API
Critical
CVE-2026-29080
Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API
Low
ghsa-7ww3-xvf5-cxwm
ciguard: Web UI is missing HTTP defence-in-depth headers
High
CVE-2026-40110
Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`
High
CVE-2026-40934
Jupyter Server's Authentication Cookies Remain Valid After Password Reset and Server Restart
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.