Medium
CVE-2026-81723
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 452
Reset filters
High
CVE-2026-62677
Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE
High
CVE-2026-54757
Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
High
CVE-2026-55585
qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`
Medium
CVE-2026-55619
eml_parser has parser DoS via deeply nested parentheses in e-mail headers
High
CVE-2026-55620
eml_parser vulnerable to DoS via deeply nested parens in Received headers
Medium
CVE-2026-55618
eml_parser has a URL extraction bypass via HTML entities in URLs
Critical
CVE-2026-55546
qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input
High
CVE-2026-55540
PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks
High
CVE-2026-55541
PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
Critical
CVE-2026-53710
mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
High
CVE-2026-55525
praisonaiagents web_crawl vulnerable to SSRF via redirect-following
Medium
CVE-2026-12570
Keras model loading is vulnerable to denial of service through HDF5 shape bombs
High
CVE-2026-53951
Copier has a trust-prefix bypass via path traversal that runs tasks unprompted
Medium
CVE-2026-69112
Accelerate path traversal and denial of service via sharded checkpoint weight_map entries
High
CVE-2026-67322
GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
High
CVE-2026-67323
GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`
High
CVE-2026-87819
GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing
High
CVE-2026-87817
GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution
Medium
ghsa-73p9-6hrp-8qhr
AIIR verification and policy gates could report success without enforcing the control (fail-open)
Medium
CVE-2026-81724
NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input
Unrated
CVE-2026-81717
openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted (attacker with physical
Medium
CVE-2026-81722
NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'
Unrated
CVE-2026-81715
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sa
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.