Medium
CVE-2026-28413
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,861
Reset filters
Critical
CVE-2026-0848
NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verific
Medium
CVE-2026-28348
lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes
Medium
CVE-2026-28350
lxml-html-clean has <base> tag injection through default Cleaner configuration
Medium
CVE-2026-28223
Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface
Medium
CVE-2026-28222
Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes
Medium
CVE-2026-28277
LangGraph checkpoint loading has unsafe msgpack deserialization
High
CVE-2026-25048
xgrammar vulnerable to DoS via multi-layer nesting
Medium
CVE-2025-69534
Python-Markdown has an Uncaught Exception
Medium
CVE-2026-27982
An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to a
High
CVE-2026-0847
A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and Brack
High
ghsa-5hwf-rc88-82xm
Fickling missing RCE-capable modules in UNSAFE_IMPORTS
High
ghsa-wccx-j62j-r448
Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked
Critical
CVE-2026-3490
PickleScan's pkgutil.resolve_name has a universal blocklist bypass
Critical
CVE-2026-53873
PickleScan's profile.run blocklist mismatch allows exec() bypass
High
CVE-2026-28416
Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing
Medium
CVE-2026-28415
Gradio has an Open Redirect in its OAuth Flow
High
CVE-2026-28414
Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+
Low
CVE-2026-27167
Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret
Medium
CVE-2026-28352
Indico has a missing access check in the event series management API
Medium
CVE-2026-28231
pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read
Medium
ghsa-747p-wmpv-9c78
AWS CLI: cli_history database does not restrict file permissions on Unix systems
Critical
CVE-2026-27966
Langflow has Remote Code Execution in CSV Agent
Critical
CVE-2026-28370
OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.