Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 36

Reset filters

High 19.10.2026

CVE-2026-108372

LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

LoopX serve-status uses an overly permissive CORS policy with wildcard headers on unauthenticated loopback read endpoints. This allows malicious websites visited by the operator to exfiltrate control-plane state and private Markdown files from registered goal repositories without user interaction.

Medium 15.10.2026

CVE-2026-102682

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

Exposing Pipecat's development runner to untrusted networks allows unauthenticated callers to create bot sessions and paid Daily rooms. This can lead to unauthorized bot interactions, local resource exhaustion, and consumption of third-party service quotas.

Medium 09.10.2026

ghsa-9q47-3cm2-2rp8

pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

Medium 05.10.2026

CVE-2026-102598

Werkzeug safe_join() allows Windows special device names

Medium 31.07.2026

CVE-2026-54707

OnionShare Receive mode writes uploaded files even when file uploads are disabled

High 17.07.2026

CVE-2026-54567

Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

High 23.06.2026

CVE-2026-54134

OctoPrint has possible file exfiltration via query parameters on upload endpoints

Low 15.06.2026

CVE-2026-53540

python-multipart: Negative Content-Length in parse_form buffers the entire body in memory

High 27.05.2026

CVE-2026-48544

Taipy contains a path traversal vulnerability

Medium 08.01.2026

CVE-2026-21860

Werkzeug safe_join() allows Windows special device names with compound extensions

Medium 02.12.2025

CVE-2025-66221

Werkzeug safe_join() allows Windows special device names

Medium 25.10.2024

CVE-2024-49767

Werkzeug possible resource exhaustion when parsing file data in forms

Medium 25.10.2024

CVE-2024-49766

Werkzeug safe_join not safe on Windows

High 06.05.2024

CVE-2024-34069

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

Medium 07.10.2022

CVE-2021-23385

Flask-Security vulnerable to Open Redirect

High 24.05.2022

CVE-2019-14322

Pallets Werkzeug vulnerable to Path Traversal

Critical 09.05.2024

CVE-2024-32874

Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service

Critical 18.11.2025

CVE-2025-65015

joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads

Medium 23.06.2026

ghsa-w2j7-f3c6-g8cw

Flask-Security has an Open Redirect issue

Medium 16.04.2026

CVE-2026-40594

pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)

High 27.03.2026

CVE-2026-33981

Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters

Critical 25.02.2026

CVE-2026-27641

Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

Medium 19.02.2026

CVE-2026-27199

Werkzeug safe_join() allows Windows special device names

Critical 29.01.2026

CVE-2026-40035

Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)

Showing 1 to 24 of 36 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 36

Know which vulnerabilities affect your application

Application security in your inbox