Critical
Exploited in attacks
CVE-2026-33017
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 733
Reset filters
High
CVE-2026-28490
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
High
CVE-2026-28498
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
Critical
CVE-2026-27962
Authlib JWS JWK Header Injection: Signature Verification Bypass
Medium
ghsa-r48f-3986-4f9c
fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist
High
CVE-2026-32597
PyJWT accepts unknown `crit` header extensions
High
CVE-2026-31899
CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification
Critical
CVE-2026-27825
MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment
High
CVE-2026-30930
Glances has SQL Injection via Process Names in TimescaleDB Export
High
CVE-2026-29778
pyLoad has an Arbitrary File Write via Path Traversal in edit_package()
Medium
CVE-2026-29038
changedetection.io has Reflected XSS in its RSS Tag Error Response
High
CVE-2026-28802
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
Medium
CVE-2026-28348
lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes
Medium
CVE-2026-28277
LangGraph checkpoint loading has unsafe msgpack deserialization
High
ghsa-5hwf-rc88-82xm
Fickling missing RCE-capable modules in UNSAFE_IMPORTS
High
ghsa-wccx-j62j-r448
Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked
Critical
CVE-2026-3490
PickleScan's pkgutil.resolve_name has a universal blocklist bypass
Critical
CVE-2026-53873
PickleScan's profile.run blocklist mismatch allows exec() bypass
Low
CVE-2026-27167
Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret
Medium
CVE-2026-27809
psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps
Critical
CVE-2026-27614
Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering
Medium
ghsa-mhc9-48gj-9gp3
Fickling has safety check bypass via REDUCE+BUILD opcode sequence
Medium
CVE-2026-27645
changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
High
ghsa-mxhj-88fx-4pcv
Fickling: OBJ opcode call invisibility bypasses all safety checks
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.