High
CVE-2026-45725
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,829
Reset filters
Low
CVE-2026-9369
hermes-agent has an Incorrect Comparison
Medium
CVE-2026-45309
AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username
Medium
CVE-2026-46745
Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability
Medium
CVE-2026-46645
SQLAdmin: Authorization Bypass on `ajax_lookup`
High
CVE-2026-3515
Prefect has an Argument Injection issue
High
CVE-2026-47102
LiteLLM allows a user to modify their own user_role via the /user/update endpoint
Medium
CVE-2026-9366
hermes-agent has an Injection issue
Medium
CVE-2026-9368
hermes-agent has a sandbox issue
Medium
CVE-2026-9353
hermes-agent has an Injection issue
Medium
CVE-2026-46715
Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance
Medium
CVE-2026-47157
aiograpi: Unsafe signup challenge path handling
Critical
CVE-2026-48207
Apache Fory PyFory Deserialization of Untrusted Data
Low
CVE-2026-46497
Crawlee for Python: SSRF via sitemap-derived URLs
Medium
CVE-2026-46561
pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API
High
CVE-2026-46517
lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out
High
CVE-2026-47101
LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit
High
CVE-2026-8596
Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path
Medium
CVE-2026-8597
Amazon SageMaker Python SDK is missing integrity verification in its Triton inference handler
Medium
CVE-2026-46556
FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
High
CVE-2026-4137
MLFlow Creates a Temporary File With Insecure Permissions
Medium
CVE-2026-46338
Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path
High
CVE-2026-48989
Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS
Medium
CVE-2026-46486
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.