Critical
CVE-2026-48746
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,358
Reset filters
Medium
CVE-2026-54911
UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()
Medium
CVE-2026-44889
WebOb: Location header normalization during redirect leads to open redirect - again
Medium
CVE-2026-41479
Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type
Critical
CVE-2026-46488
motionEye: Authentication possible via password hash
Medium
CVE-2026-55443
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
High
CVE-2026-54293
Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read
Low
CVE-2026-54280
aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect
Low
CVE-2026-54279
aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
Medium
CVE-2026-54278
aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup
Medium
CVE-2026-54277
aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines
Medium
CVE-2026-54276
aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
High
CVE-2026-54283
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
Low
CVE-2026-54282
Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
Low
CVE-2026-54275
aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections
Medium
CVE-2026-54273
aiohttp: HTTP/1 Pipelined Requests Queue Without Limit
Medium
CVE-2026-54274
aiohttp: Incomplete websocket frame payloads bypass memory limits
Low
CVE-2026-50269
aiohttp: CRLF injection in multipart headers
Medium
CVE-2025-71378
Picklescan is missing detection when calling built-in Python cProfile.runctx
High
CVE-2025-71357
Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand
High
CVE-2025-71348
Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config
High
CVE-2026-56340
vLLM introduced enhanced protection for CVE-2025-62164
Medium
CVE-2026-56304
picklescan vulnerable to arbitrary file create using logging.FileHandler
Medium
CVE-2026-58203
pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.