High
CVE-2023-41267
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 452
Reset filters
Medium
CVE-2023-39523
ScanCode.io command injection in docker image fetch process
High
CVE-2026-54060
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
Medium
CVE-2021-20180
Insertion of Sensitive Information into Log File in ansible
High
CVE-2026-57516
Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)
Critical
CVE-2026-48039
Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token
Critical
CVE-2026-22778
vLLM has RCE In Video Processing
Critical
CVE-2026-47393
PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default
Critical
CVE-2026-32871
FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
Critical
CVE-2025-53890
pyLoad vulnerable to XSS through insecure CAPTCHA
Critical
CVE-2025-65015
joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads
Critical
CVE-2025-47277
vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
Critical
CVE-2025-27520
BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
Critical
CVE-2026-49257
mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind
Medium
ghsa-75mw-h36v-2jv7
Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers
Critical
ghsa-98x5-vq43-vc5p
semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin
Critical
CVE-2026-48797
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
Medium
CVE-2026-77088
justhtml: to_markdown() code-span blank-line breakout enables XSS
High
CVE-2026-54293
Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read
Medium
CVE-2026-54273
aiohttp: HTTP/1 Pipelined Requests Queue Without Limit
Medium
CVE-2026-58198
ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer
High
ghsa-p5wc-9w9r-m232
Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser
High
ghsa-8823-qg2x-pv9f
Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit
High
CVE-2026-57586
agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.