High
ghsa-52vm-mxx8-f227
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,358
Reset filters
Medium
CVE-2026-35211
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOperator
Medium
ghsa-mxwc-wh95-pw4g
Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler
High
CVE-2026-59939
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
Medium
CVE-2026-58501
Zeep: Server-Side Request Forgery (SSRF)
Medium
CVE-2026-59930
Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content
High
CVE-2026-59925
Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
Medium
CVE-2026-59926
Mistune: XSS via unescaped class option in Admonition directive
Medium
CVE-2026-59929
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
Medium
CVE-2026-59927
Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
Medium
CVE-2026-59924
Mistune: Arbitrary File Read via Include directive path traversal
High
CVE-2026-59928
Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
Medium
CVE-2026-59890
setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
Medium
CVE-2026-59923
Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
High
CVE-2026-59922
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
Low
CVE-2026-14966
BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the
Low
CVE-2026-14967
BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY
Medium
ghsa-f66q-9rf6-8795
Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion
Medium
ghsa-q855-8rh5-jfgq
ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path
High
CVE-2026-53874
picklescan missing detection by simple obfuscation of a `builtins.eval` call
High
CVE-2026-1777
SageMaker Python SDK has Exposed HMAC
High
CVE-2025-70560
Boltz contains an insecure deserialization vulnerability in its molecule loading functionality
Medium
CVE-2026-25517
Wagtail has improper permission handling on admin preview endpoints
High
CVE-2026-1778
SageMaker Python SDK has Insecure TLS Configuration
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.