Critical
CVE-2026-39890
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 733
Reset filters
Medium
CVE-2026-35592
pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass
High
CVE-2026-35463
pyLoad: Improper Neutralization of Special Elements used in an OS Command
Medium
CVE-2026-33865
MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface
Critical
CVE-2026-1114
In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing JSON Web Tokens (JWT). This vulnerabilit
Critical
CVE-2026-39305
PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator
High
CVE-2026-35044
BentoML: SSTI via Unsandboxed Jinja2 in Dockerfile Generation
Medium
CVE-2026-34756
vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server
Medium
CVE-2026-34755
vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing
High
CVE-2026-34824
Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service
High
CVE-2026-33533
Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
Critical
CVE-2026-34934
PraisonAI Has Second-Order SQL Injection in `get_all_user_threads`
Critical
CVE-2026-34938
PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code
Critical
ghsa-955r-262c-33jc
Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2
Unrated
pysec-2026-3
Two telnyx versions published containing credential harvesting malware
Medium
CVE-2026-33314
Improper Authentication and Origin Validation Error in pyload-ng
High
CVE-2026-5389
JustHTML is vulnerable to XSS via code fence breakout in <pre> content
Critical
CVE-2026-33309
Langflow has an Arbitrary File Write (RCE) via v2 API
High
CVE-2026-26209
cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads
Medium
CVE-2026-33230
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nltk
High
CVE-2026-32874
UltraJSON has a Memory Leak parsing large integers allows DoS
Critical
CVE-2026-33057
Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py
Critical
CVE-2026-33054
Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion
High
CVE-2026-30922
Denial of Service in pyasn1 via Unbounded Recursion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.