High
CVE-2026-114098
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 240
Reset filters
Medium
CVE-2026-97688
urllib3: Chunked Deflate streaming can enter an infinite loop
Medium
CVE-2026-101918
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
Medium
CVE-2026-101917
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
Medium
CVE-2026-102270
PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
High
CVE-2026-102271
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
Medium
CVE-2026-61541
Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service
High
CVE-2026-77271
MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)
High
CVE-2026-77243
MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
Medium
CVE-2026-85078
sanic chunked trailer request smuggling allows hidden second request execution
Medium
CVE-2026-59823
LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
Medium
CVE-2026-87014
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
Medium
CVE-2026-88006
Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
Medium
CVE-2026-87012
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
Medium
CVE-2026-87013
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
High
CVE-2026-87998
Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
Medium
CVE-2026-88005
Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange
Medium
CVE-2026-102904
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs
Medium
CVE-2026-102275
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
Unrated
CVE-2026-100841
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MON
Medium
CVE-2026-88000
Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree
Medium
CVE-2026-88002
Open WebUI: Any authenticated user can hang the server via a cyclic chat message history
Medium
CVE-2026-84305
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
High
CVE-2026-55830
RestrictedPython guard hooks can be shadowed via positional-only arguments
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.