Medium
CVE-2026-86597
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,787
Reset filters
High
CVE-2026-104851
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
High
ghsa-v853-p72q-4cfw
Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__
High
CVE-2026-104873
LangGraph SDK custom auth silently ignores actions= on resource decorators
Medium
CVE-2026-105751
Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
Critical
CVE-2026-9205
Langflow: Weak Fernet Key via random.seed()
Critical
CVE-2026-8505
Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass
High
CVE-2026-51886
Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description
High
CVE-2026-7700
Langflow: Prompt injection in Langflow Smart Transform can lead to code execution
Medium
CVE-2026-105750
Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode
Medium
CVE-2026-105743
Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
High
CVE-2026-105744
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Medium
CVE-2026-105746
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/
Medium
CVE-2026-105747
Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)
Medium
CVE-2026-105745
Docling imports plugin entry points before the allow_external_plugins check
Medium
CVE-2026-105749
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
Low
CVE-2026-105742
Docling: Configured HTTP headers sent to every remote image host named by a document
High
CVE-2026-71416
Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)
Critical
ghsa-v2f8-6655-7grj
Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
High
ghsa-5rmq-chc7-m22f
Vibe-Trading file-read tools expose arbitrary server-readable files
Critical
ghsa-jqmf-mx4f-hfr6
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
Medium
CVE-2026-77387
geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point
High
ghsa-8mcx-5rqc-vhmf
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
Medium
ghsa-35mr-4567-66vg
Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.