Critical
CVE-2026-47391
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,319
Reset filters
Medium
CVE-2026-47395
PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
Critical
CVE-2026-47396
PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset
Medium
CVE-2026-47390
PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
Medium
CVE-2026-114109
uv is vulnerable to arbitrary file write through entry point names
Medium
ghsa-qp9x-wp8f-qgjj
tuf has platform-dependent delegation path matching
Medium
CVE-2026-42999
OpenStack Keystone has an Authorization Bypass
High
CVE-2026-45078
Synapse CPU starvation (Denial of Service)
Medium
CVE-2026-48525
PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS
Medium
CVE-2026-48522
PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes
High
CVE-2026-45017
python-liquid: Absolute paths escape filesystem loader search path
High
CVE-2026-44660
UltraJSON has a Memory Leak in ujson.dump() on Write Failure
High
CVE-2026-44346
Dockerfile command injection via envs[*].name in bentofile.yaml (sibling fix-bypass of CVE-2026-33744 and CVE-2026-35043)
Medium
CVE-2026-44353
Streamlink has an arbitrary local file read via file:// URI in HLS and DASH
Medium
CVE-2026-44899
Mistune Image Directive CSS Injection Vulnerability
Medium
CVE-2026-44897
Mistune Heading ID Attribute has Injection XSS
High
CVE-2026-44730
OpenCTI: Privilege escalation via graphQL API is abusable by organization admins, due to incorrect ACL on userEdit relationAdd
Medium
Exploited in attacks
CVE-2026-48710
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Critical
CVE-2026-46703
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
Critical
CVE-2026-46695
BoxLite: Permission Bypass Allows Modification of Read-Only Files
Medium
CVE-2026-2734
MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks
High
ghsa-mw8f-w6p8-xrf4
wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None
Critical
CVE-2026-45568
rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths
Critical
ghsa-wx9m-wx4f-4cmg
Malicious dropper in mistralai 2.4.6 PyPI package
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.