High
CVE-2026-50180
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 240
Reset filters
Medium
CVE-2026-55165
Lemur: JWT verifier honors attacker-supplied alg, enabling ATO
High
CVE-2026-53925
Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
Medium
CVE-2026-48487
zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet
Medium
CVE-2026-55206
py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()
Medium
CVE-2026-46611
Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
High
CVE-2026-46607
Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution
High
CVE-2026-46606
Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
High
CVE-2026-50023
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
High
CVE-2026-50574
yt-dlp: Arbitrary code execution via manifest downloads with aria2c
High
CVE-2026-53539
python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
Low
CVE-2026-53538
python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
High
CVE-2026-48060
Litestar has HTML Injection Through its CSRF Token
High
CVE-2026-47394
PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate
High
CVE-2026-46439
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
High
CVE-2026-42305
Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
High
CVE-2026-45725
compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal
Medium
CVE-2026-8597
Amazon SageMaker Python SDK is missing integrity verification in its Triton inference handler
High
CVE-2026-45402
Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints
High
CVE-2026-45348
pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal
High
CVE-2026-45350
Open WebUI's chat completion API allows tool restrictions to be bypassed
Medium
CVE-2026-44337
PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries
Medium
CVE-2026-44550
Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts
High
CVE-2026-44334
PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.