Critical
CVE-2026-44336
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 733
Reset filters
High
CVE-2021-47935
Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary commands by injecting malicious pickle-serialized objects through the audit log en
High
CVE-2026-44721
open-webui Vulnerable to Stored XSS via Model Description
High
ghsa-v7qw-hx66-4w9x
netbox-data-flows has stored XSS in ObjectAlias names rendered inside DataFlow tables
High
CVE-2026-42284
GitPython: Unsafe option check validates multi_options before shlex.split transformation
Medium
ghsa-7f4h-6264-89fr
axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
Low
ghsa-7mw3-79jq-xc7f
aiograpi has dependency on vulnerable orjson 3.11.4 (CVE-2025-67221)
High
CVE-2026-86257
wger: CSV/TSV formula injection in gym member export (first_name/last_name)
Critical
CVE-2026-42048
Langflow Knowledge Bases API is Vulnerable to Path Traversal
Critical
CVE-2026-42864
FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft
Medium
CVE-2026-42086
OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender
Critical
CVE-2025-62373
Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer
High
CVE-2026-41241
pretalx vulnerable to stored cross-site scripting in organizer search typeahead
Medium
CVE-2026-6827
justhtml has sanitization bypass in custom policies and programmatic DOM
High
CVE-2026-25917
Apache Airflow allows code execution through crafted XCom payloads
Medium
CVE-2026-40491
gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall
High
CVE-2026-41496
PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)
High
CVE-2026-33858
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly tru
Medium
CVE-2026-1116
A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior to version 2.2.0. The vulnerability arises from the lack of
Critical
CVE-2026-40157
PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`
Critical
CVE-2026-40154
PraisonAI Vulnerable Untrusted Remote Template Code Execution
Critical
CVE-2026-40111
PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)
High
CVE-2026-39981
AGiXT Vulnerable to Path Traversal in safe_join()
Critical
CVE-2026-39888
PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.