High
CVE-2026-45315
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 58
Reset filters
High
CVE-2026-42561
python-multipart has Denial of Service via unbounded multipart part headers
Medium
CVE-2026-40115
PraisonAI has Unrestricted Upload Size in WSGI Recipe Registry Server that Enables Memory Exhaustion DoS
High
CVE-2026-40116
PraisonAI: Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits
High
CVE-2026-33010
mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft
High
CVE-2025-62727
Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``
Medium
CVE-2025-54121
Starlette has possible denial-of-service vector when parsing large files in multipart forms
High
CVE-2024-32982
Litestar and Starlite vulnerable to Path Traversal
High
CVE-2024-53981
Denial of service (DoS) via deformation `multipart/form-data` boundary
High
CVE-2024-47874
Starlette Denial of service (DoS) via multipart/form-data
Medium
CVE-2026-55646
vLLM: Speech-to-text upload size limit is enforced after full UploadFile read
Critical
CVE-2026-48039
Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token
Critical
CVE-2026-49468
LiteLLM: Authentication Bypass via Host Header Injection
Critical
CVE-2025-54381
BentoML SSRF Vulnerability in File Upload Processing
Critical
CVE-2025-65015
joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads
Critical
CVE-2026-48746
vLLM: OpenAI auth bypass
High
CVE-2026-54283
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
Low
CVE-2026-54282
Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
High
CVE-2026-57112
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
Medium
CVE-2026-48817
Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`
High
CVE-2026-48818
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
Medium
Exploited in attacks
CVE-2026-48710
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Critical
CVE-2026-44336
PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection
High
ghsa-52cq-7v8r-62c6
gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.