High
ghsa-mxhj-88fx-4pcv
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 426
Reset filters
Medium
CVE-2026-27156
NiceGUI vulnerable to XSS via Code Injection during client-side element function execution
Medium
CVE-2026-25516
NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
High
CVE-2026-25640
Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL
Critical
CVE-2026-25592
Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK
Medium
ghsa-gpx9-96j6-pp87
TaskWeaver has Protection Mechanism Failure and Server-Side Request Forgery (SSRF)
Medium
CVE-2026-22773
vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions
High
CVE-2025-68478
External Control of File Name or Path in Langflow
Medium
CVE-2025-68113
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
Critical
ghsa-58p5-r2f6-g2cj
Pixar OpenUSD Sdf_PathNode Module Use-After-Free Vulnerability Leading to Potential Remote Code Execution
Medium
CVE-2025-71340
Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode
Medium
CVE-2025-71371
Picklescan has a missing detection when calling built-in python code.InteractiveInterpreter
Medium
CVE-2025-48945
pycares has a Use-After-Free Vulnerability
Medium
CVE-2025-3122
A vulnerability classified as problematic was found in WebAssembly wabt 1.0.36. Affected by this vulnerability is the function BinaryReaderInterp::BeginFunctionBody of the file src/interp/binary-reade
Medium
CVE-2025-2584
A vulnerability was found in WebAssembly wabt 1.0.36. It has been declared as critical. This vulnerability affects the function BinaryReaderInterp::GetReturnCallDropKeepCount of the file wabt/src/inte
Critical
CVE-2024-9053
vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints
High
ghsa-v432-7f47-9g94
PostQuantum-Feldman-VSS'S Dependency Vulnerability in gmpy2 Leading to Interpreter Crash
High
CVE-2025-2368
A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical. This issue affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport of the file wabt/src/
Medium
CVE-2025-1945
Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch
High
ghsa-vp47-9734-prjw
ASTEVAL Allows Malicious Tampering of Exposed AST Nodes Leads to Sandbox Escape
Unrated
CVE-2024-52338
Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it
High
CVE-2024-52595
HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through
Critical
CVE-2024-47533
cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes
Medium
CVE-2024-47529
OpenC3 stores passwords in clear text (`GHSL-2024-129`)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.