High
CVE-2026-54134
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,334
Reset filters
Medium
CVE-2026-31978
motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint
Medium
CVE-2026-32315
motionEye's World-Readable Configuration File Exposes Admin Password Hash
High
CVE-2025-67303
ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)
Medium
CVE-2026-55206
py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()
Medium
CVE-2026-46611
Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
High
CVE-2026-46607
Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution
High
CVE-2026-46606
Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
Medium
CVE-2026-55837
dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
High
CVE-2026-46608
Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
High
CVE-2026-23879
py7zr: Arbitrary File Write Vulnerability
High
CVE-2026-54528
jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
High
CVE-2026-54695
Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID
Medium
CVE-2026-12565
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
High
CVE-2026-54008
Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
High
CVE-2026-54013
Open WebUI: Stored XSS to Account Takeover via Model Profile Images
High
CVE-2026-54017
Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
Medium
CVE-2026-54019
Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode
Medium
CVE-2026-54016
Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration
Medium
CVE-2026-54021
Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter
Medium
CVE-2026-54022
Open WebUI: Any authenticated user can read other users' private notes via Socket.IO
Medium
CVE-2026-54014
Open WebUI: Sibling-Prefix Path Traversal via /cache/{path}
Medium
CVE-2026-54009
Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field
High
CVE-2026-50023
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.