Low
CVE-2026-46497
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 116
Reset filters
Medium
CVE-2026-46556
FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
High
CVE-2026-45400
Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`
High
CVE-2026-45331
Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature
Medium
CVE-2026-45299
Open WebUI has Stored Cross-Site Scripting In Profile Picture
Medium
CVE-2026-43979
local-deep-research is Vulnerable to HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)
Medium
CVE-2026-44337
PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries
Medium
CVE-2026-44520
docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler
Medium
CVE-2026-41206
PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code
High
CVE-2026-40114
PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API
High
CVE-2026-40116
PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits
Medium
CVE-2026-34753
vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `
High
CVE-2026-40072
web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling
Medium
CVE-2026-34052
LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)
High
CVE-2025-15381
MLFlow allows Tracing + Assessments Access
High
CVE-2026-33139
PySpector has a Plugin Sandbox Bypass leads to Arbitrary Code Execution
High
ghsa-h4g2-xfmw-q2c9
Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset
Medium
ghsa-f66q-9rf6-8795
Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion
Medium
CVE-2025-67743
Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service
High
CVE-2025-68477
Langflow vulnerable to Server-Side Request Forgery
High
CVE-2025-60787
motionEye vulnerable to RCE via unsanitized motion config parameter
Medium
CVE-2026-53878
Django: DomainNameValidator permits newline characters that may enable HTTP header injection
Medium
CVE-2024-43371
Potential access to sensitive URLs via CKAN extensions (SSRF)
Medium
CVE-2023-45813
TorBot vulnerable to Inefficient Regular Expression Complexity in validate_link
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.