High
CVE-2026-28500
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,861
Reset filters
High
CVE-2026-27459
pyOpenSSL DTLS cookie callback buffer overflow
Low
CVE-2026-27448
pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback
High
CVE-2026-32981
A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file
Medium
CVE-2026-4270
Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access
Critical
Exploited in attacks
CVE-2026-33017
Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint
High
CVE-2026-21886
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to all
Medium
CVE-2026-28563
Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dep
High
CVE-2026-30911
Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve,
High
CVE-2026-28779
Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.
Medium
CVE-2026-26929
Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a
High
CVE-2026-28490
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
High
CVE-2026-28498
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
Critical
CVE-2026-32633
Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
Critical
CVE-2026-27962
Authlib JWS JWK Header Injection: Signature Verification Bypass
High
CVE-2026-32640
SimpleEval: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox
Medium
ghsa-5cxw-w2xg-2m8h
fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE`
Medium
ghsa-r48f-3986-4f9c
fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist
High
CVE-2026-105782
Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
High
CVE-2026-32597
PyJWT accepts unknown `crit` header extensions
High
CVE-2026-31899
CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification
High
CVE-2026-32274
Black: Arbitrary file writes from unsanitized user input in cache file name
High
CVE-2026-21887
OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature
Critical
CVE-2026-3059
SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.