High
CVE-2026-35043
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 426
Reset filters
High
CVE-2026-34591
Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write
Critical
CVE-2026-34935
PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()
Low
CVE-2026-34520
AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass
Medium
CVE-2026-34231
Slippers Vulnerable to Cross-Site Scripting (XSS) in `attrs` Template Tag
High
CVE-2026-33744
BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml
High
CVE-2026-33718
OpenHands is Vulnerable to Command Injection through its Git Diff Handler
High
CVE-2026-5389
JustHTML is vulnerable to XSS via code fence breakout in <pre> content
High
CVE-2026-26209
cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads
High
CVE-2026-32875
UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
Critical
CVE-2026-33057
Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py
High
CVE-2026-32634
Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers
High
CVE-2026-32611
Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements
High
CVE-2026-30922
Denial of Service in pyasn1 via Unbounded Recursion
High
CVE-2026-28498
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
Critical
CVE-2026-32633
Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
Medium
ghsa-r48f-3986-4f9c
fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist
High
CVE-2026-105782
Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
Critical
CVE-2026-27825
MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment
Medium
CVE-2026-29038
changedetection.io has Reflected XSS in its RSS Tag Error Response
Medium
CVE-2026-28348
lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes
High
CVE-2026-28416
Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing
Medium
CVE-2026-27809
psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps
Medium
CVE-2026-27645
changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.