Critical
CVE-2026-50027
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 426
Reset filters
Medium
CVE-2026-55163
Lemur Privilege Escalation: Non-admin role members can rewrite role membership via PUT /api/1/roles/<id>
High
CVE-2026-53925
Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
Medium
CVE-2026-48775
LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading
High
CVE-2026-46606
Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
High
CVE-2026-12530
Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
High
CVE-2026-54011
Open WebUI: Stored XSS in Mermaid Markdown Preview
Medium
CVE-2026-54019
Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode
Medium
CVE-2026-54009
Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field
High
CVE-2026-54007
Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
Medium
CVE-2026-12491
vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations
High
CVE-2026-50574
yt-dlp: Arbitrary code execution via manifest downloads with aria2c
Low
CVE-2026-53537
python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
Low
CVE-2026-53538
python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
High
CVE-2026-12398
Galaxy NG: command injection vulnerability
High
CVE-2026-47781
PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing
Medium
CVE-2026-47763
PDM: Project-Local State and Config Writes Follow Symlinks
Low
CVE-2026-47192
kas's late signature validation may allow unnoticed repository manipulations
High
CVE-2026-47418
praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR
Medium
CVE-2026-47408
praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership
High
CVE-2026-47414
praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)
High
CVE-2026-42305
Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
High
CVE-2026-10105
agno contains a SQL injection vulnerability
Low
CVE-2026-46497
Crawlee for Python: SSRF via sitemap-derived URLs
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.