Medium
CVE-2026-27457
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,861
Reset filters
High
CVE-2026-27961
Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator template rendering. Although the vul
Critical
CVE-2026-27941
OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out a
Medium
CVE-2026-27948
Copyparty vulnerable to reflected XSS via setck parameter
Critical
CVE-2026-27952
Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability existed in Agenta's custom code evaluator. Agenta used RestrictedPython as a sand
Medium
CVE-2026-27809
psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps
Critical
CVE-2026-27641
Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection
Critical
CVE-2026-27614
Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering
Medium
ghsa-mhc9-48gj-9gp3
Fickling has safety check bypass via REDUCE+BUILD opcode sequence
Medium
CVE-2026-27645
changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
High
CVE-2026-27696
changedetection.io is Vulnerable to SSRF via Watch URLs
High
ghsa-mxhj-88fx-4pcv
Fickling: OBJ opcode call invisibility bypasses all safety checks
Medium
CVE-2026-27156
NiceGUI vulnerable to XSS via Code Injection during client-side element function execution
Low
CVE-2026-23983
Apache Superset allows authenticated users to view sensitive data without explicit permissions
High
CVE-2026-23982
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
CVE-2026-23984
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
Medium
CVE-2026-23980
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
CVE-2026-23969
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
High
CVE-2026-27483
MindsDB: Path Traversal in /api/files Leading to Remote Code Execution
Critical
CVE-2026-26198
ormar is vulnerable to SQL Injection through aggregate functions min() and max()
Medium
CVE-2026-27482
Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
Medium
CVE-2026-27199
Werkzeug safe_join() allows Windows special device names
Low
CVE-2026-27205
Flask session does not add `Vary: Cookie` header when accessed in some ways
Low
ghsa-83pf-v6qq-pwmr
Fickling has a detection bypass via stdlib network-protocol constructors
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.