Medium
CVE-2026-40315
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 422
Reset filters
High
CVE-2026-40113
PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars
Medium
CVE-2026-40112
PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)
High
CVE-2026-34444
Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr
Medium
CVE-2026-26981
OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
High
CVE-2026-33752
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
High
CVE-2026-34937
PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution
Medium
CVE-2025-64340
FastMCP has a Command Injection vulnerability - Gemini CLI
Medium
CVE-2026-34400
alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API
High
CVE-2026-33980
Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries
High
CVE-2026-28788
Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
Medium
CVE-2026-33545
MobSF has SQL Injection in its SQLite Database Viewer Utils
Medium
CVE-2026-33140
Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution
High
CVE-2025-14287
MLflow has a command injection in mlflow/sagemaker/__init__.py
High
CVE-2026-32247
Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters
Medium
CVE-2026-25960
vLLM has SSRF Protection Bypass
Medium
CVE-2026-29787
mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint
Medium
CVE-2026-25734
Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata
Medium
CVE-2026-25736
Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute
High
CVE-2026-25733
Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function
High
CVE-2026-25136
Rucio WebUI has a Reflected Cross-site Scripting Vulnerability
Medium
CVE-2026-25735
Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name
High
CVE-2026-26331
yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
High
CVE-2026-1669
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.