Medium
CVE-2026-41132
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,359
Reset filters
Medium
CVE-2026-42052
beets has a Cross-site Scripting vulnerability
Medium
CVE-2026-7149
kaggle-mcp has a Path Traversal issue
Medium
CVE-2026-6550
AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache
Low
CVE-2026-6878
verl's math_equal() Vulnerable to Arbitrary Code Execution via Unsafe eval()
Low
CVE-2026-41140
Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4
High
CVE-2026-33626
LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
High
CVE-2026-6859
InstructLab Includes Functionality from Untrusted Control Sphere
Medium
CVE-2026-6606
AgentScope vulnerable to Server-Side Request Forgery
Low
CVE-2026-6587
RAGAS has SSRF via Multi-Modal Faithfulness Collections Module
Low
CVE-2026-6599
Langflow vulnerable to injection
Low
CVE-2026-6598
Langflow: Cleartext Storage of Authentication Settings in Project Creation Endpoint
Low
CVE-2026-6597
Langflow has an Information Leak through Incomplete API Key Redaction
Medium
CVE-2026-6596
Langflow: DoS Through Lack of File Size Restriction via Deprecated Unauthenticated File Upload API
Medium
CVE-2026-6604
AgentScope vulnerable to Server-Side Request Forgery
Medium
CVE-2026-40948
apache-airflow-providers-keycloak: Missing OAuth 2.0 State and PKCE Enables Login CSRF and Session Fixation
High
CVE-2026-41490
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
Medium
CVE-2026-41313
pypdf: Possible long runtimes for wrong size values in incremental mode
Low
CVE-2026-35402
Neo4j Labs MCP Servers: SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures
Medium
CVE-2026-40602
Home Assistant Command-line Interface: Handling of user-supplied Jinja2 templates
Medium
CVE-2026-40353
wger has Stored XSS via Unescaped License Attribution Fields
Medium
CVE-2026-40347
python-multipart affected by Denial of Service via large multipart preamble or epilogue data
Critical
CVE-2026-54334
UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen
Critical
CVE-2026-54333
UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.