High
CVE-2026-34222
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,016
Reset filters
High
CVE-2026-34937
PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution
High
CVE-2026-27124
FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities
Medium
CVE-2025-64340
FastMCP has a Command Injection vulnerability - Gemini CLI
Medium
CVE-2026-34400
alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API
High
CVE-2025-15381
MLFlow allows Tracing + Assessments Access
High
CVE-2026-34172
Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment
High
CVE-2026-33980
Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries
High
CVE-2026-33509
pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration
Medium
CVE-2026-28786
Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`
High
CVE-2026-28788
Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
Medium
CVE-2026-33545
MobSF has SQL Injection in its SQLite Database Viewer Utils
Medium
CVE-2026-32889
Denial of service via non-terminating SYLT frame parsing loop in tinytag
High
CVE-2026-32116
Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite
Medium
CVE-2026-32112
ha-mcp has XSS via Unescaped HTML in OAuth Consent Form
High
CVE-2026-32247
Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters
Medium
CVE-2026-32111
ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle
High
CVE-2025-69196
FastMCP OAuth Proxy token reuse across MCP servers
Medium
CVE-2026-31815
django-unicorn affected by component state manipulation via unvalidated attribute access
Medium
CVE-2026-29787
mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint
High
CVE-2026-33010
mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft
High
CVE-2026-27826
MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers
High
CVE-2026-28795
OpenChatBI has a Path Traversal Vulnerability in save_report Tool
Medium
CVE-2026-27695
zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.