Medium
CVE-2026-54009
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,336
Reset filters
High
CVE-2026-50023
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
Medium
CVE-2026-50019
yt-dlp: File Downloader cookie leak with curl
Medium
CVE-2026-54006
Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar
Medium
CVE-2026-54236
vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
Low
CVE-2026-53537
python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
Low
CVE-2026-53540
python-multipart: Negative Content-Length in parse_form buffers the entire body in memory
High
CVE-2026-53539
python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
Low
CVE-2026-53538
python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
High
CVE-2026-49853
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
Medium
CVE-2026-42867
Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint
High
CVE-2026-48099
WsgiDAV encoded dot segments can escape filesystem share roots
Medium
CVE-2026-48045
python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood
Medium
CVE-2026-47763
PDM: Project-Local State and Config Writes Follow Symlinks
Medium
CVE-2026-48053
Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset
Medium
CVE-2026-54445
Vantage6: Set admin user and password from environment or configuration
Low
CVE-2026-47715
Bugsink: Issue event views can show an event from another project if its UUID is known
High
CVE-2026-48060
Litestar has HTML Injection Through its CSRF Token
Medium
CVE-2026-48061
Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header
Low
CVE-2026-47712
Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`
Low
CVE-2026-47716
Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known
High
CVE-2026-47419
praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR
High
CVE-2026-44023
Docling Core: Unsafe remote filename resolution
High
CVE-2026-47415
praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.