Low
CVE-2026-59213
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,319
Reset filters
Medium
CVE-2026-61632
PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
Medium
CVE-2026-59218
Open WebUI: Account enumeration via observable login timing discrepancy
High
CVE-2026-69097
GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
Medium
CVE-2026-45339
Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints
High
CVE-2026-59200
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
High
CVE-2026-54058
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
Medium
CVE-2026-59198
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
High
CVE-2026-54549
meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch
High
CVE-2026-54547
meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
High
CVE-2026-54567
Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)
Critical
CVE-2026-61740
LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
Critical
CVE-2026-61736
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
High
CVE-2026-54234
vLLM has Remote DoS via Invalid Recovered Token Reinjection
High
CVE-2026-54552
sh _uid does not drop supplementary groups (incomplete privilege drop)
High
CVE-2026-59950
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
High
CVE-2026-52869
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
High
CVE-2026-54446
NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode
High
CVE-2026-54449
LangBot: Authenticated RCE Via MCP Configuration
High
CVE-2026-61668
DIRAC: Pilot code downloaded over unverified HTTPS connection
Critical
CVE-2026-57147
praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery
High
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
Critical
CVE-2026-57496
netlicensing-mcp: REST Path Traversal Bypasses Token Redaction
High
CVE-2026-57143
PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.