Medium
CVE-2026-45347
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,334
Reset filters
Medium
CVE-2026-45317
Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation
High
CVE-2026-43977
wger Vulnerable to IDOR: Authenticated Users Can Read Any User's Private Workout Session Data via Template Routine API
High
CVE-2026-43978
wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager
Medium
CVE-2026-45306
pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad
High
CVE-2026-45301
Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file
Medium
CVE-2026-45299
Open WebUI has Stored Cross-Site Scripting In Profile Picture
High
CVE-2026-44541
ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override
Medium
CVE-2026-44968
dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters
Low
CVE-2026-44970
dbt MCP Server Transmits All MCP Tool Arguments Including Raw SQL and --vars Credentials to dbt Labs Telemetry by Default Without Redaction
Low
CVE-2026-44969
dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled
High
CVE-2026-7819
pgAdmin 4 File Manager has symbolic-link path traversal
Medium
CVE-2026-43979
local-deep-research is Vulnerable to HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)
High
CVE-2026-31253
flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism
High
CVE-2026-31248
Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks
High
CVE-2026-7817
pgAdmin 4 contains local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities
Medium
CVE-2026-44972
GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content
High
CVE-2026-44971
GuardDog has a blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
High
CVE-2026-44340
PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
High
CVE-2026-44569
Open WebUI's Insecure Message Access Breaks Authorization
Medium
CVE-2026-44571
Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission
Medium
CVE-2026-44844
eml_parser has recursion DoS via nested message/rfc822 attachments
High
CVE-2026-44567
Open WebUI has Improper Authorization Control
Medium
CVE-2026-44562
Open WebUI's Model Import Overwrites Any Model Without Ownership Check
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.