High
CVE-2026-16796
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 426
Reset filters
High
CVE-2026-59216
Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
High
CVE-2026-59214
Open WebUI: Stored web worker XSS via Pyodide
Medium
CVE-2026-59198
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
High
CVE-2026-54446
NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode
High
CVE-2026-54449
LangBot: Authenticated RCE Via MCP Configuration
Critical
CVE-2026-57496
netlicensing-mcp: REST Path Traversal Bypasses Token Redaction
High
CVE-2026-57130
PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
Critical
CVE-2026-57131
PraisonAI: Jobs API exposes agent-execution endpoints with no authentication
High
CVE-2026-57117
PraisonAI: Compute-bridged file tools allow shell command injection
High
CVE-2026-56840
PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools
High
CVE-2026-58659
PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters
High
CVE-2026-59884
pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
High
CVE-2026-59885
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
High
CVE-2026-59205
Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch
High
ghsa-xf7x-x43h-rpqh
json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS
High
CVE-2026-54071
BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py
Critical
CVE-2026-54769
Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent
High
CVE-2026-54771
Langroid: handle_message() executes user-supplied tool JSON without sender verification
Critical
CVE-2026-54760
Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls
Critical
CVE-2026-55615
Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879
High
CVE-2026-55786
flyto-core has Unauthenticated Command Execution via HTTP MCP `execute_module`
High
CVE-2026-49852
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)
Critical
CVE-2026-52830
fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.