High
ghsa-c2jp-c369-7pvx
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,015
Reset filters
Critical
CVE-2025-62515
pyquokka is Vulnerable to Remote Code Execution by Pickle Deserialization via FlightServer
Critical
CVE-2025-10283
BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE
Critical
CVE-2025-10284
BBOT's various issues in unarchive.py can cause arbitrary file write and RCE
Medium
CVE-2025-61587
Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is configured with Anubis and REDIRECT_DOMAINS is
Medium
ghsa-xjv7-6w92-42r7
marimo vulnerable to proxy abuse of /mpl/{port}/
Critical
CVE-2025-6237
InvokeAI has External Control of File Name or Path
Critical
CVE-2025-10156
Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check
Critical
CVE-2025-10155
Picklescan Bypass is Possible via File Extension Mismatch
Critical
CVE-2025-59377
mcp-kubernetes-server has an OS Command Injection vulnerability
High
CVE-2025-58755
MONAI does not prevent path traversal, potentially leading to arbitrary file writes
Critical
ghsa-58p5-r2f6-g2cj
Pixar OpenUSD Sdf_PathNode Module Use-After-Free Vulnerability Leading to Potential Remote Code Execution
High
CVE-2023-41471
Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKE
High
CVE-2025-8747
Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality
Medium
CVE-2025-51481
Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the not
High
CVE-2025-53528
Cadwyn vulnerable to XSS on the docs page
High
CVE-2025-6209
LlamaIndex vulnerable to Path Traversal attack through its encode_image function
Critical
CVE-2025-2828
A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically, langchain_community.agent_toolkits.openapi.toolkit.Requests
Critical
CVE-2025-6278
A vulnerability classified as critical was found in Upsonic up to 0.55.6. This vulnerability affects the function os.path.join of the file markdown/server.py. The manipulation of the argument file.fil
Medium
CVE-2025-6050
Mezzanine CMS has a Stored Cross-Site Scripting (XSS) vulnerability in the displayable_links_js function
Critical
CVE-2025-6167
A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5. Affected is the function create_workflow of the file python_a2a/agent_flow/server/api.py. The manipulatio
Low
CVE-2025-43866
Vantage6 Server JWT secret not cryptographically secure
Critical
CVE-2025-1750
LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id
Medium
CVE-2025-48943
vLLM allows clients to crash the openai server with invalid regex
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.