Medium
CVE-2026-47408
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 185
Reset filters
High
CVE-2026-47406
praisonai-platform: IDOR in dependency endpoints allows cross-workspace issue linking, reading, and deletion due to missing ownership checks
Medium
CVE-2026-45309
AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username
High
CVE-2026-46517
lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out
Medium
CVE-2026-46383
Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`
High
CVE-2026-45671
Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion
High
CVE-2026-45338
Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)
High
CVE-2026-44843
LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists
Medium
CVE-2026-33936
python-ecdsa: Denial of Service via improper DER length validation in crafted private keys
High
CVE-2026-28788
Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
High
CVE-2026-27932
joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)
Medium
CVE-2026-73497
MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)
Medium
ghsa-f66q-9rf6-8795
Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion
Low
CVE-2025-68142
PyMdown Extensions has a ReDOS bug in its Figure Capture extension
Medium
CVE-2025-68481
FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO
High
CVE-2025-70559
Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
High
CVE-2025-65106
LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates
Medium
CVE-2025-51464
Aim vulnerable to Cross-site Scripting
Low
CVE-2025-5321
Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution
High
CVE-2025-0190
Aim Excessive Data Query Operations in a Large Data Table vulnerability
High
CVE-2025-0189
Aim Uncontrolled Resource Consumption vulnerability
High
CVE-2024-8061
Aim allows denial of service due to no timeouts for some tracking server endpoints
Medium
CVE-2024-8238
Aim Improper Access Control
High
CVE-2024-7760
Aim vulnerable to Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.