Medium
CVE-2026-25528
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,319
Reset filters
Medium
CVE-2026-25480
Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)
Medium
CVE-2026-25479
Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns
High
CVE-2026-25478
Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins
High
CVE-2026-25732
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
High
CVE-2026-25640
Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL
High
CVE-2026-25580
Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling
High
CVE-2026-1207
Django has an SQL Injection issue
Critical
CVE-2026-25505
Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication
Critical
CVE-2026-40035
Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)
Medium
ghsa-gpx9-96j6-pp87
TaskWeaver has Protection Mechanism Failure and Server-Side Request Forgery (SSRF)
Medium
CVE-2026-23528
Dask Distributed is Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard
High
CVE-2025-68472
MindsDB has improper sanitation of filepath that leads to information disclosure and DOS
Critical
CVE-2025-61781
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation" allows users to del
High
CVE-2026-21445
Langflow Missing Authentication on Critical API Endpoints
High
CVE-2025-14930
Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of
High
CVE-2025-14928
Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hu
High
CVE-2025-14929
Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af
High
CVE-2025-14926
Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Huggi
High
CVE-2025-14927
Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hug
High
CVE-2025-14920
Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected instal
High
CVE-2025-14921
Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected i
High
CVE-2025-14924
Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installa
High
CVE-2025-68478
External Control of File Name or Path in Langflow
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.