High
CVE-2026-97687
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,319
Reset filters
Medium
CVE-2026-102269
PyJWT: Non-canonical signature segments enable raw-token revocation bypass
Critical
CVE-2026-102268
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
High
CVE-2026-102272
PyJWT BOM Bypass
Medium
CVE-2026-102265
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
Medium
CVE-2026-102274
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
Medium
CVE-2026-101917
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
Medium
CVE-2026-102270
PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
High
CVE-2026-102271
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
Medium
CVE-2026-57176
social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend
High
CVE-2026-57443
SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
Medium
CVE-2026-57179
social-auth-core has a Session Fixation issue
Medium
CVE-2026-57175
social-auth-core has an Improper Authentication issue
Medium
CVE-2026-57177
social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend
High
CVE-2026-57171
Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
Medium
CVE-2026-92164
Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files
Critical
CVE-2026-91130
Home Assistant: XSS in Statistics Graph Card
Medium
CVE-2026-83805
Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs
Medium
CVE-2026-91129
Home Assistant: mDNS Server-Side Request Forgery
Medium
CVE-2026-85709
lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses
High
CVE-2026-85740
lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
Critical
CVE-2026-85734
lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
Medium
CVE-2026-85725
lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function
Medium
CVE-2026-83801
Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.