High
CVE-2026-62675
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,794
Reset filters
High
CVE-2026-78680
NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary
Medium
CVE-2026-71492
Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root
Medium
CVE-2026-73228
Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`
Critical
CVE-2026-55248
plone.app.portlets vulnerable to denial of service via RSS feed portlet
Medium
CVE-2026-55227
Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups
High
CVE-2026-55228
Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project
High
CVE-2026-55509
WsgiDAV MySQL provider has a blind SQL injection
High
CVE-2026-55520
Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching
High
CVE-2026-55830
RestrictedPython guard hooks can be shadowed via positional-only arguments
High
CVE-2026-55485
piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
Critical
CVE-2026-55247
plone.app.event vulnerable to denial of service via iCalendar import
Medium
CVE-2026-73229
Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests
Medium
CVE-2026-54553
Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
Medium
CVE-2026-54770
WebOb: Open redirect in Location header normalization via leading C0 control / space characters
Critical
CVE-2026-54569
senaite.core Vulnerable to Eval Injection and Missing Authorization
Low
CVE-2026-54548
kas Persistently Disables SSH Host Key Checking
Critical
CVE-2026-37004
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
Medium
CVE-2026-55558
aiosmtplib: STARTTLS response injection
High
CVE-2026-54591
asyncssh has SCP Path Traversal to Arbitrary File Write
Medium
CVE-2026-54590
asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution
High
CVE-2026-54757
Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
High
CVE-2026-55099
icalendar has Algorithmic Complexity in Equality
Critical
CVE-2026-55640
nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.