High
CVE-2026-79674
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 685
Reset filters
High
ghsa-8cp3-qxj6-px34
utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion
Critical
CVE-2026-78676
GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE
High
CVE-2026-78675
GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)
High
CVE-2026-70626
NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root
High
CVE-2026-71417
Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it
Medium
CVE-2026-71317
Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority
High
CVE-2026-71308
Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates
High
CVE-2026-70666
Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
Critical
Exploited in attacks
CVE-2026-64849
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
Medium
CVE-2026-68924
MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
Medium
CVE-2026-68922
MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads
High
CVE-2026-59893
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
Medium
CVE-2026-53708
ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
Medium
CVE-2026-59894
sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes
High
CVE-2026-73568
libp2p: yamux connection DoS via oversized data frame
Unrated
CVE-2026-74889
openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key
Critical
CVE-2026-74878
openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart
Medium
CVE-2026-74874
openssl-encrypt has non-cryptographic PRNG used for steganography pixel selection
High
CVE-2026-73620
GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read
High
CVE-2026-73622
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
Medium
CVE-2026-73619
GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()
Medium
CVE-2026-71852
pypdf: Possible long runtimes/large memory usage for large CID font width ranges
Medium
CVE-2026-71870
pypdf: Possible large memory usage for large /ToUnicode streams
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.