High
CVE-2026-51886
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 733
Reset filters
Medium
CVE-2026-105749
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
High
CVE-2026-71416
Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)
Critical
CVE-2026-114108
Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
Critical
CVE-2026-114107
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
High
CVE-2026-114094
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
High
CVE-2026-114096
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
High
CVE-2026-114097
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
High
CVE-2026-114098
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
Medium
CVE-2026-101918
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
Medium
CVE-2026-102269
PyJWT: Non-canonical signature segments enable raw-token revocation bypass
High
CVE-2026-102272
PyJWT BOM Bypass
High
CVE-2026-102266
PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
Medium
CVE-2026-102270
PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
Medium
CVE-2026-49264
Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
High
CVE-2026-57171
Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
Critical
CVE-2026-91130
Home Assistant: XSS in Statistics Graph Card
Medium
CVE-2026-86062
lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content
Medium
CVE-2026-83801
Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text
Critical
CVE-2026-77244
[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token
High
CVE-2026-77271
MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)
High
CVE-2026-77274
MCP Atlassian: SSRF Protection Bypass
High
CVE-2026-77257
MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths
Medium
CVE-2026-77272
MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.