Medium
CVE-2026-5388
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 430
Reset filters
Critical
CVE-2026-40088
PraisonAI Vulnerable to OS Command Injection
Medium
CVE-2026-39844
NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
High
CVE-2026-35167
Kedro: Path Traversal in versioned dataset loading via unsanitized version string
High
CVE-2026-35043
BentoML: Command Injection in cloud deployment setup script
High
CVE-2026-34591
Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write
Critical
CVE-2026-34935
PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()
Low
CVE-2026-34520
AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass
Medium
CVE-2026-34231
Slippers Vulnerable to Cross-Site Scripting (XSS) in `attrs` Template Tag
High
CVE-2026-33744
BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml
High
CVE-2026-33718
OpenHands is Vulnerable to Command Injection through its Git Diff Handler
High
CVE-2026-5389
JustHTML is vulnerable to XSS via code fence breakout in <pre> content
High
CVE-2026-26209
cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads
High
CVE-2026-32875
UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
Critical
CVE-2026-33057
Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py
High
CVE-2026-32634
Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers
High
CVE-2026-32611
Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements
High
CVE-2026-30922
Denial of Service in pyasn1 via Unbounded Recursion
High
CVE-2026-28498
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
Critical
CVE-2026-32633
Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
Medium
ghsa-r48f-3986-4f9c
fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist
High
CVE-2026-105782
Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
Critical
CVE-2026-27825
MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment
Medium
CVE-2026-29038
changedetection.io has Reflected XSS in its RSS Tag Error Response
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.