High
CVE-2026-40934
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,319
Reset filters
High
CVE-2026-35397
Jupyter Server: Path Traversal via incorrect startswith() root directory check allows access to sibling directories
Critical
CVE-2026-42048
Langflow Knowledge Bases API is Vulnerable to Path Traversal
High
CVE-2026-43001
OpenStack Keystone has an Incorrect Authorization Issue
Medium
CVE-2026-41016
apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider
Medium
CVE-2026-41481
LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass
Medium
CVE-2026-41425
Authlib: Cross-site request forging when using cache
Critical
CVE-2025-62373
Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer
High
CVE-2026-41205
Mako: Path traversal via double-slash URI prefix in TemplateLookup
Critical
CVE-2026-3960
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient secu
Medium
CVE-2026-40594
pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)
High
CVE-2026-35587
Glances has SSRF in IP Plugin via public_api leading to credential leakage
High
CVE-2026-34839
Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS
Medium
CVE-2026-28684
python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback
Medium
CVE-2026-40491
gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall
Medium
CVE-2026-40256
Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision
Low
CVE-2026-7808
Multiple security fixes in justhtml
Critical
CVE-2026-40576
excel-mcp-server has a Path Traversal issue
Critical
CVE-2026-40258
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
Medium
CVE-2026-39921
GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outboun
Medium
CVE-2026-39922
GeoNode contains a server-side request forgery vulnerability in the service registration endpoint
Medium
ghsa-vj8v-p5vw-m6v5
xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern
Low
CVE-2026-114110
uv vulnerable to arbitrary file deletion through RECORD entries
Critical
CVE-2026-40289
PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.