High
CVE-2026-105801
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,319
Reset filters
Medium
ghsa-j8f7-x8jm-wmm4
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)
Low
CVE-2026-105752
vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle
Medium
CVE-2026-96747
PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption
Medium
CVE-2026-105758
vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach
Medium
CVE-2026-105754
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
Medium
CVE-2026-105756
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service
Medium
CVE-2026-102991
Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
Medium
CVE-2026-104874
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
Medium
CVE-2026-105753
vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core
High
CVE-2026-104851
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
Medium
CVE-2026-105751
Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
High
CVE-2026-51886
Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description
High
CVE-2026-7700
Langflow: Prompt injection in Langflow Smart Transform can lead to code execution
High
CVE-2026-105744
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Medium
CVE-2026-105747
Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)
Medium
CVE-2026-105745
Docling imports plugin entry points before the allow_external_plugins check
Critical
CVE-2026-114108
Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
High
CVE-2026-114106
Vibe-Trading file-read tools expose arbitrary server-readable files
Critical
CVE-2026-114107
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
High
CVE-2026-114094
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
High
CVE-2026-114096
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
High
CVE-2026-114097
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
High
CVE-2026-114098
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.