Critical
CVE-2026-40154
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,016
Reset filters
High
CVE-2026-56075
PraisonAI: Hardcoded `approval_mode="auto"` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command Execution
Medium
CVE-2026-5388
justhtml includes multiple security fixes
Medium
CVE-2026-40086
Rembg has a Path Traversal via Custom Model Loading
High
CVE-2026-39981
AGiXT Vulnerable to Path Traversal in safe_join()
Critical
CVE-2026-40088
PraisonAI Vulnerable to OS Command Injection
Critical
Exploited in attacks
CVE-2026-39987
Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
Critical
CVE-2026-39890
PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading
Low
CVE-2026-5751
justhtml: Mutation XSS with custom foreign-namespace sanitization policies
Medium
CVE-2026-39373
JWCrypto: JWE ZIP decompression bomb
High
CVE-2026-39376
FastFeedParser has an infinite redirect loop DoS via meta-refresh chain
Medium
CVE-2026-35586
pyload-ng: Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng
High
CVE-2026-35526
strawberry-graphql: Denial of Service via unbounded WebSocket subscriptions
High
CVE-2026-35167
Kedro: Path Traversal in versioned dataset loading via unsanitized version string
Medium
CVE-2026-34756
vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server
Medium
CVE-2026-34755
vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing
Critical
CVE-2026-35459
pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)
High
CVE-2026-34824
Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service
Medium
CVE-2026-33709
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links whi
High
CVE-2026-33641
Glances Vulnerable to Command Injection via Dynamic Configuration Values
High
CVE-2026-33533
Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
Critical
CVE-2026-34953
PraisonAI Has Authentication Bypass via OAuthManager.validate_token()
Critical
CVE-2026-34952
PraisonAI Has Missing Authentication in WebSocket Gateway
Critical
CVE-2026-34935
PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.