High
CVE-2026-44209
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 452
Reset filters
High
CVE-2026-44555
Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
High
CVE-2026-44556
Open WebUI's responses passthrough endpoint lacks access control authorization
High
CVE-2026-44334
PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)
Medium
CVE-2026-44520
docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler
High
CVE-2026-44307
Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup
Low
CVE-2026-44220
ciguard: discover_pipeline_files follows symlinks out of scan root
High
CVE-2026-42301
pyp2spec is Vulnerable to Code Injection
Medium
CVE-2026-6357
pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
Medium
CVE-2026-3219
pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files
High
CVE-2026-41490
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
Low
CVE-2026-40319
Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check
Medium
CVE-2026-40159
PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution
High
CVE-2026-40160
PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback
High
CVE-2026-40158
PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure
High
CVE-2026-40156
PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading
High
CVE-2026-40153
PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool
High
CVE-2026-40113
PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars
Medium
CVE-2026-40112
PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)
Medium
CVE-2026-33753
rfc3161-client Has Improper Certificate Validation
High
CVE-2026-34544
OpenEXR: integer overflow to OOB write in uncompress_b44_impl()
High
CVE-2026-34954
PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL
High
CVE-2026-34955
PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox
High
CVE-2026-34936
PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.