High
CVE-2026-26118
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,015
Reset filters
Medium
CVE-2026-30974
copyparty: volflag `nohtml` did not block javascript in svg files
High
CVE-2026-30928
Glances Exposes Unauthenticated Configuration Secrets
High
CVE-2026-30930
Glances has SQL Injection via Process Names in TimescaleDB Export
High
ghsa-qr2g-p6q7-w82m
x402 SDK Security Advisory
High
CVE-2026-29065
changedetection.io has Zip Slip vulnerability in the backup restore functionality
Medium
CVE-2026-29038
changedetection.io has Reflected XSS in its RSS Tag Error Response
High
CVE-2026-28681
IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links
High
CVE-2026-30242
Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer
Medium
CVE-2026-28350
lxml-html-clean has <base> tag injection through default Cleaner configuration
High
CVE-2026-0847
A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and Brack
High
ghsa-wccx-j62j-r448
Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked
High
CVE-2026-28416
Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing
Medium
CVE-2026-28415
Gradio has an Open Redirect in its OAuth Flow
High
CVE-2026-28414
Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+
Low
CVE-2026-27167
Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret
Medium
CVE-2026-28352
Indico has a missing access check in the event series management API
Medium
CVE-2026-28231
pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read
Critical
CVE-2026-27966
Langflow has Remote Code Execution in CSV Agent
High
CVE-2026-27961
Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator template rendering. Although the vul
Medium
CVE-2026-27948
Copyparty vulnerable to reflected XSS via setck parameter
Critical
CVE-2026-27952
Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability existed in Agenta's custom code evaluator. Agenta used RestrictedPython as a sand
Critical
CVE-2026-27641
Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection
Medium
ghsa-mhc9-48gj-9gp3
Fickling has safety check bypass via REDUCE+BUILD opcode sequence
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.