High
CVE-2026-45314
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 733
Reset filters
High
CVE-2026-45348
pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal
High
CVE-2026-45315
Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
Medium
CVE-2026-45347
Open WebUI vulnerable to blind server side request forgery (SSRF) via the PDF generate function
High
CVE-2026-44541
ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override
Medium
CVE-2026-44968
dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters
Low
CVE-2026-44970
dbt MCP Server Transmits All MCP Tool Arguments Including Raw SQL and --vars Credentials to dbt Labs Telemetry by Default Without Redaction
Low
CVE-2026-44969
dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled
High
CVE-2026-7818
pgAdmin 4 has deserialization of untrusted data in its FileBackedSessionManager
Medium
CVE-2026-43979
local-deep-research is Vulnerable to HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)
Medium
CVE-2026-6420
Keylime has a hardcoded attestation challenge nonce that allows replay attacks
High
CVE-2026-31247
Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks
High
CVE-2026-44340
PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
High
CVE-2026-44843
LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists
Medium
CVE-2026-44844
eml_parser has recursion DoS via nested message/rfc822 attachments
Medium
CVE-2026-44564
Read-Only Open WebUI Users Can Modify Collaborative Documents via Socket.IO
Medium
CVE-2026-44562
Open WebUI's Model Import Overwrites Any Model Without Ownership Check
High
CVE-2026-44549
Open WebUI has stored XSS in Excel file preview
High
CVE-2026-44209
banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI
High
CVE-2026-44555
Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
High
CVE-2026-44552
Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning
High
CVE-2026-44641
Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install
High
CVE-2026-44334
PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)
Medium
CVE-2026-44222
vLLM Vulnerable to Remote DoS via Special-Token Placeholders
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.