Medium
CVE-2026-44899
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 685
Reset filters
Medium
CVE-2026-44708
Mistune Math Plugin has an XSS Escape Bypass
Critical
CVE-2026-46703
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
Critical
CVE-2026-46695
BoxLite: Permission Bypass Allows Modification of Read-Only Files
High
ghsa-mw8f-w6p8-xrf4
wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None
High
CVE-2026-2652
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and
High
CVE-2026-42304
Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
Medium
CVE-2026-44223
vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters
High
CVE-2026-43891
changedetection.io has an Arbitrary Local File Read via a crafted backup restore
High
CVE-2026-41895
changedetection.io project has an XXE vulnerability
High
CVE-2026-42313
pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
Medium
ghsa-88q9-cmp2-c2vq
oxidize-pdf: NaN/inf bypass in colour content-stream emission causes PDF rejection (DoS)
High
CVE-2026-56400
Open WebUI has a CORS misconfiguration and session validation issue
High
CVE-2026-44339
PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute
Medium
CVE-2026-42308
Pillow has an integer overflow when processing fonts
High
CVE-2026-44503
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
Medium
ghsa-7f4h-6264-89fr
axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
Critical
CVE-2026-43948
wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
Critical
CVE-2026-29090
Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API
Critical
CVE-2026-29080
Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API
Medium
ghsa-8pqq-224h-x875
ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key
Low
CVE-2026-41488
langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding
Medium
CVE-2026-41425
Authlib: Cross-site request forging when using cache
Medium
CVE-2026-39377
nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.