High
CVE-2026-45398
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 685
Reset filters
Medium
CVE-2026-45318
Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)
High
CVE-2026-43978
wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager
Medium
CVE-2026-45299
Open WebUI has Stored Cross-Site Scripting In Profile Picture
Low
CVE-2026-44970
dbt MCP Server Transmits All MCP Tool Arguments Including Raw SQL and --vars Credentials to dbt Labs Telemetry by Default Without Redaction
Medium
CVE-2026-43979
local-deep-research is Vulnerable to HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)
High
CVE-2026-31248
Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks
High
CVE-2026-44340
PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
Medium
CVE-2026-44560
Open WebUI has Unauthorized File and Knowledge Base Content Access via RAG Vector Search
Medium
CVE-2026-44557
Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection
High
CVE-2026-44556
Open WebUI's responses passthrough endpoint lacks access control authorization
High
CVE-2026-44335
PraisonAI has an SSRF bypass
High
CVE-2026-44504
Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)
Medium
CVE-2026-44226
PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI
Low
CVE-2026-44220
ciguard: discover_pipeline_files follows symlinks out of scan root
High
CVE-2026-33079
Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input
Medium
CVE-2026-43901
wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured
Medium
CVE-2026-42310
Pillow has a PDF Parsing Trailer Infinite Loop (DoS)
Medium
CVE-2026-7206
sqlite-mcp has an Injection issue
Low
CVE-2026-41140
Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4
Medium
CVE-2026-40353
wger has Stored XSS via Unescaped License Attribution Fields
Low
CVE-2026-40319
Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check
Medium
CVE-2026-40320
Giskard has Unsandboxed Jinja2 Template Rendering in ConformityCheck
High
CVE-2026-40160
PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.