High
CVE-2026-26192
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,334
Reset filters
Low
CVE-2026-53759
Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases
High
CVE-2026-55426
Linuxfabrik Monitoring Plugins have local privilege escalation using embedded command
Critical
CVE-2026-54769
Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent
Critical
CVE-2026-54760
Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls
Medium
CVE-2026-54724
Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint
High
CVE-2026-55786
flyto-core has Unauthenticated Command Execution via HTTP MCP `execute_module`
High
CVE-2026-55787
flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf
High
CVE-2026-49852
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)
High
CVE-2026-50181
Langroid: Path traversal in the file tools allows read/write outside configured current directory
High
CVE-2026-50180
Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read
High
CVE-2026-52726
Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload
Critical
CVE-2026-50027
mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete
High
CVE-2026-49986
Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`
Medium
CVE-2025-11000
Open Babel has out-of-bounds read in PQS lowerit (pre-buffer read)
Medium
CVE-2026-55163
Lemur Privilege Escalation: Non-admin role members can rewrite role membership via PUT /api/1/roles/<id>
Medium
CVE-2026-55165
Lemur: JWT verifier honors attacker-supplied alg, enabling ATO
Medium
CVE-2026-55162
Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF
Medium
CVE-2026-55164
Lemur user-update path stores plaintext passwords
High
CVE-2026-48813
Flawfinder output manipulation via untrusted filenames and source text
Medium
CVE-2026-35163
OctoPrint has XSS in its Suppressed Command Notifications
Medium
CVE-2026-55863
motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution
High
CVE-2026-55488
motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read
High
CVE-2026-53925
Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.