High
CVE-2026-39889
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,359
Reset filters
Medium
CVE-2026-40087
LangChain has incomplete f-string validation in prompt templates
High
CVE-2026-39308
PraisonAI recipe registry publish path traversal allows out-of-root file write
Medium
CVE-2026-33753
rfc3161-client Has Improper Certificate Validation
Medium
CVE-2026-40071
pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions
High
CVE-2026-34589
OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write
Medium
CVE-2026-22680
OpenViking contains a missing authorization vulnerability in the task polling endpoints
High
CVE-2026-34588
OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
High
CVE-2026-34444
Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr
Medium
CVE-2026-1163
parisneo/lollms has an insufficient session expiration vulnerability
Medium
CVE-2026-39413
lightrag-hku: JWT Algorithm Confusion Vulnerability
High
CVE-2026-39306
PraisonAI recipe registry pull path traversal writes files outside the chosen output directory
High
CVE-2026-39307
PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction
High
CVE-2026-35464
pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)
Medium
CVE-2025-64182
OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()
Medium
CVE-2026-26981
OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
Medium
CVE-2025-64183
OpenEXR has use after free in PyObject_StealAttrString
Low
CVE-2025-64181
OpenEXR Makes Use of Uninitialized Memory
Medium
CVE-2026-35492
kedro-datasets has a path traversal vulnerability in PartitionedDataset that allows arbitrary file write
Medium
CVE-2026-34753
vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `
High
CVE-2026-33752
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
High
CVE-2026-34543
OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)
High
CVE-2026-34544
OpenEXR: integer overflow to OOB write in uncompress_b44_impl()
High
CVE-2026-40072
web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.