Critical
ghsa-98x5-vq43-vc5p
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,334
Reset filters
Critical
CVE-2026-48797
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
Medium
ghsa-72w7-mf9g-733p
nono-py has proxy-only network fallback bypass on older Linux kernels
Medium
CVE-2026-44018
Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
Critical
CVE-2026-55166
Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise
Medium
CVE-2026-77088
justhtml: to_markdown() code-span blank-line breakout enables XSS
High
CVE-2026-44017
Docling: Unsafe Zip Extraction in EasyOCR Model Download
Critical
CVE-2026-56260
Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution
Medium
ghsa-w2j7-f3c6-g8cw
Flask-Security has an Open Redirect issue
High
CVE-2026-53755
Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check
Critical
ghsa-phv5-334h-mxcw
motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal
Critical
ghsa-qxvg-h7q2-hcxh
motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)
High
CVE-2026-54317
Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
Critical
CVE-2026-48519
Langflow: Unauthenticated RCE in Shareable Playgrounds
High
CVE-2026-33760
Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints
High
CVE-2026-41523
vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution
Critical
CVE-2026-48746
vLLM: OpenAI auth bypass
Medium
CVE-2026-44889
WebOb: Location header normalization during redirect leads to open redirect - again
Critical
CVE-2026-46488
motionEye: Authentication possible via password hash
Medium
CVE-2026-55443
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
High
CVE-2026-54293
Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read
Low
CVE-2026-54280
aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect
Medium
CVE-2026-54276
aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
High
CVE-2026-54283
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.