High
CVE-2026-44023
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,015
Reset filters
High
CVE-2026-47417
praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR
High
CVE-2026-47405
PraisonAI Platform: Missing role checks let any workspace member become owner and control workspace membership
High
CVE-2026-48169
PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API
High
CVE-2026-47399
PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID
Low
CVE-2026-10177
Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint
High
CVE-2026-47394
PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate
Medium
CVE-2026-47213
BoxLite has a Timeout Bypass Vulnerability
High
CVE-2026-10108
xiaomusic contains an unauthenticated path traversal vulnerability
Medium
CVE-2026-46380
compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem
High
CVE-2026-46439
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
Medium
CVE-2026-45774
compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal
High
CVE-2026-46345
compliance-trestle - jinja has an Arbitrary File Write via Path Traversal
High
CVE-2026-49017
OpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body
High
CVE-2026-48544
Taipy contains a path traversal vulnerability
High
CVE-2026-45725
compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal
Low
CVE-2026-9369
hermes-agent has an Incorrect Comparison
Medium
CVE-2026-45309
AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username
High
CVE-2026-3515
Prefect has an Argument Injection issue
Medium
CVE-2026-46715
Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance
Medium
CVE-2026-47157
aiograpi: Unsafe signup challenge path handling
Medium
CVE-2026-46561
pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API
High
CVE-2026-46517
lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out
High
CVE-2026-8596
Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.