Medium
CVE-2026-30912
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 685
Reset filters
Medium
CVE-2026-40491
gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall
Medium
CVE-2026-41182
LangSmith SDK: Streaming token events bypass output redaction
Medium
ghsa-55v6-g8pm-pw4c
rembg server is vulnerable to Server-Side Request Forgery (SSRF) and a weak default CORS configuration
Critical
CVE-2026-40258
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
Medium
CVE-2026-56074
PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands
Critical
CVE-2026-40157
PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`
Critical
CVE-2026-39888
PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
High
CVE-2026-39376
FastFeedParser has an infinite redirect loop DoS via meta-refresh chain
Medium
CVE-2026-35592
pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass
Critical
CVE-2026-35490
changedetection.io Vulnerable to Authentication Bypass via Decorator Ordering
High
CVE-2026-35043
BentoML: Command Injection in cloud deployment setup script
Medium
CVE-2026-34755
vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing
Medium
CVE-2026-34760
vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models
High
CVE-2026-33641
Glances Vulnerable to Command Injection via Dynamic Configuration Values
High
CVE-2026-33533
Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
Medium
CVE-2026-34515
AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
High
CVE-2026-32727
SciTokens has an Authorization Bypass via Path Traversal in Scope Validation
Critical
ghsa-955r-262c-33jc
Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2
Critical
CVE-2026-0558
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not e
Medium
ghsa-7fqq-q52p-2jjg
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
Critical
CVE-2026-33873
Langflow has Authenticated Code Execution in Agentic Assistant Validation
Medium
CVE-2026-25645
Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
High
CVE-2026-5389
JustHTML is vulnerable to XSS via code fence breakout in <pre> content
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.