Medium
CVE-2026-105753
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,334
Reset filters
High
CVE-2026-104851
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
Medium
CVE-2026-105751
Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
High
CVE-2026-51886
Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description
High
CVE-2026-7700
Langflow: Prompt injection in Langflow Smart Transform can lead to code execution
High
CVE-2026-105744
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Medium
CVE-2026-105747
Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)
Medium
CVE-2026-105745
Docling imports plugin entry points before the allow_external_plugins check
Critical
CVE-2026-114108
Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
High
CVE-2026-114106
Vibe-Trading file-read tools expose arbitrary server-readable files
Critical
CVE-2026-114107
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
High
CVE-2026-114094
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
High
CVE-2026-114096
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
High
CVE-2026-114097
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
High
CVE-2026-114098
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
High
CVE-2026-97687
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
Medium
CVE-2026-102269
PyJWT: Non-canonical signature segments enable raw-token revocation bypass
Critical
CVE-2026-102268
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
High
CVE-2026-102272
PyJWT BOM Bypass
Medium
CVE-2026-102265
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
Medium
CVE-2026-102274
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
Medium
CVE-2026-101917
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
Medium
CVE-2026-102270
PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
High
CVE-2026-102271
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.