Critical
CVE-2026-54569
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,319
Reset filters
Medium
CVE-2026-55558
aiosmtplib: STARTTLS response injection
High
CVE-2026-54591
asyncssh has SCP Path Traversal to Arbitrary File Write
Medium
CVE-2026-54590
asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution
Critical
CVE-2026-55640
nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
High
CVE-2026-55585
qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`
Medium
CVE-2026-55419
reachy_mini Allows Unrestricted Upload of File with Dangerous Type
Medium
CVE-2026-55619
eml_parser has parser DoS via deeply nested parentheses in e-mail headers
Critical
CVE-2026-45018
Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution
High
CVE-2026-45019
Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access
Critical
CVE-2026-55546
qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input
High
CVE-2026-55539
PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete
Critical
CVE-2026-55536
PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
High
CVE-2026-55533
PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret
High
CVE-2026-55527
praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location
High
CVE-2026-55532
PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server
High
CVE-2026-55526
praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
High
CVE-2026-55524
praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)
High
CVE-2026-55528
praisonaiagents: AgentServer declares auth_token but never enforces it on any route
High
CVE-2026-55540
PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks
High
CVE-2026-55534
PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution
High
CVE-2026-55538
PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated
Medium
CVE-2026-55531
PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)
Medium
CVE-2026-55530
praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.