High
CVE-2026-56840
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 87
Reset filters
High
CVE-2026-55787
flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf
High
CVE-2026-48809
python-engineio has possible denial of service due to maximum payload size sometimes not being enforced
High
CVE-2026-54695
Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID
High
CVE-2026-54008
Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
Medium
CVE-2026-54022
Open WebUI: Any authenticated user can read other users' private notes via Socket.IO
Medium
CVE-2026-54009
Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field
High
CVE-2026-45401
Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)
High
CVE-2026-45338
Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)
Medium
CVE-2026-44661
utcp-http vulnerable to SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol
Medium
CVE-2026-34753
vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `
High
CVE-2026-40072
web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling
Medium
CVE-2026-25960
vLLM has SSRF Protection Bypass
Medium
CVE-2025-69229
AIOHTTP vulnerable to DoS through chunked messages
Low
CVE-2025-69230
AIOHTTP Vulnerable to Cookie Parser Warning Storm
Medium
CVE-2025-69228
AIOHTTP vulnerable to denial of service through large payloads
Medium
CVE-2025-69227
AIOHTTP vulnerable to DoS when bypassing asserts
Low
CVE-2025-69224
AIOHTTP's unicode processing of header values could cause parsing discrepancies
Low
CVE-2025-69226
AIOHTTP vulnerable to brute-force leak of internal static file path components
Low
CVE-2025-69225
AIOHTTP has unicode match groups in regexes for ASCII protocol elements
High
CVE-2025-69223
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
Low
CVE-2025-53643
AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections
High
CVE-2025-25305
Home Assistant does not correctly validate SSL for outgoing requests in core and used libs
Medium
CVE-2024-52304
aiohttp allows request smuggling due to incorrect parsing of chunk extensions
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.