Medium
CVE-2026-113724
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 243
Reset filters
Medium
CVE-2026-112899
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
Medium
CVE-2026-111059
Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML
Medium
CVE-2026-112394
Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
An out-of-bounds read vulnerability in Pillow allows certain decoders to read heap memory past the end of a buffer when processing specific image dimensions. This may disclose adjacent memory into decoded pixel data or cause an application crash.
High
CVE-2026-112392
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
Applying rank, median, minimum, or maximum filters to zero-width or zero-height images in Pillow triggers a NULL pointer dereference in ImagingExpand, causing Python worker processes to crash and enabling denial of service.
High
CVE-2026-112390
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
A vulnerability in Pillow allows crafted Microsoft Image Composer (MIC) files with embedded TIFF streams to cause an infinite loop and 100% CPU usage when checking frame counts, leading to denial of service in environments with olefile installed.
High
CVE-2026-112400
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
An issue in Pillow allows a maliciously crafted GIF to cause excessive memory allocation when an application handles decompression errors during frame seeking and reuses the image object. This can lead to memory exhaustion and denial of service.
Medium
CVE-2026-102832
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
A vulnerability in JupyterLab allows a command link trust prompt to mark a currently active document as trusted instead of the clicked one, potentially allowing buttons in untrusted documents to execute without confirmation.
Medium
CVE-2026-107841
pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents
An authorization bypass in pacioli's document-layer consent gate allows nested operations to cancel caller-specified pre-existing documents without human consent markers or denial audit entries.
Medium
ghsa-9q47-3cm2-2rp8
pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
High
ghsa-889w-m37p-88m5
pyLoad: Api.set_user_permission never invalidates the target's session
Medium
ghsa-p3pr-8f3m-4qp8
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
Medium
CVE-2026-75597
pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo
High
CVE-2026-107728
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
High
CVE-2026-61435
PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
Medium
CVE-2026-61431
PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace
Medium
CVE-2026-46438
wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry
Medium
CVE-2026-45161
wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
High
CVE-2026-43976
wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
Medium
ghsa-j8f7-x8jm-wmm4
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)
Low
CVE-2026-105752
vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle
Medium
CVE-2026-96747
PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption
Medium
CVE-2026-105758
vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach
Medium
CVE-2026-105756
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.