Medium
CVE-2026-40151
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 685
Reset filters
Medium
CVE-2026-40148
PraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits
Medium
CVE-2026-56078
PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling
High
CVE-2026-40116
PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits
Medium
CVE-2026-33753
rfc3161-client Has Improper Certificate Validation
High
CVE-2026-34588
OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
High
CVE-2026-39306
PraisonAI recipe registry pull path traversal writes files outside the chosen output directory
High
CVE-2026-39307
PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction
Medium
CVE-2026-26981
OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
Medium
CVE-2025-64183
OpenEXR has use after free in PyObject_StealAttrString
Low
CVE-2025-64181
OpenEXR Makes Use of Uninitialized Memory
High
CVE-2026-34543
OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)
High
CVE-2026-34544
OpenEXR: integer overflow to OOB write in uncompress_b44_impl()
High
CVE-2026-40072
web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling
High
CVE-2026-35187
pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter
Medium
CVE-2026-34939
PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()
High
CVE-2025-15381
MLFlow allows Tracing + Assessments Access
Low
CVE-2026-33045
Home Assistant has stored XSS in history-graphs
High
CVE-2026-33509
pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration
Medium
CVE-2026-28786
Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`
Medium
CVE-2026-33545
MobSF has SQL Injection in its SQLite Database Viewer Utils
High
CVE-2025-15031
Arbitrary file write via tar traversal in mlflow
Medium
CVE-2026-32889
Denial of service via non-terminating SYLT frame parsing loop in tinytag
High
CVE-2026-28356
multipart vulnerable to ReDoS in `parse_options_header()`
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.