Critical
CVE-2026-39888
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,333
Reset filters
Critical
CVE-2026-39890
PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading
High
CVE-2026-39376
FastFeedParser has an infinite redirect loop DoS via meta-refresh chain
Medium
CVE-2026-35592
pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass
Medium
CVE-2026-35586
pyload-ng: Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng
High
CVE-2026-35523
strawberry-graphql: Authentication bypass via legacy graphql-ws WebSocket subprotocol
High
CVE-2026-3902
Django vulnerable to ASGI header spoofing via underscore/hyphen conflation
High
CVE-2026-35463
pyLoad: Improper Neutralization of Special Elements used in an OS Command
Critical
CVE-2026-35615
PraisonAI Has Path Traversal in FileTools
Critical
CVE-2026-39305
PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator
Critical
CVE-2026-35171
Kedro has Arbitrary Code Execution via Malicious Logging Configuration
High
CVE-2026-35044
BentoML: SSTI via Unsandboxed Jinja2 in Dockerfile Generation
Critical
CVE-2026-35459
pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)
High
CVE-2026-34824
Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service
High
CVE-2026-34591
Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write
High
CVE-2026-33641
Glances Vulnerable to Command Injection via Dynamic Configuration Values
High
CVE-2026-33533
Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
Critical
CVE-2026-34953
PraisonAI Has Authentication Bypass via OAuthManager.validate_token()
Critical
CVE-2026-34952
PraisonAI Has Missing Authentication in WebSocket Gateway
Critical
CVE-2026-34938
PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code
Medium
CVE-2026-34525
AIOHTTP accepts duplicate Host headers
Medium
CVE-2026-34447
ONNX: External Data Symlink Traversal
High
CVE-2026-27489
onnx Vulnerable to Path Traversal via Symlink
Medium
CVE-2026-34452
Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.