High
CVE-2026-78682
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 733
Reset filters
Medium
CVE-2026-66393
Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS
High
CVE-2026-62385
NLTK: Stable FrameNet and NKJP readers parse outside-root XML
Medium
CVE-2026-76239
stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address
High
CVE-2026-76222
GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
High
CVE-2026-71308
Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates
Critical
Exploited in attacks
CVE-2026-64849
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
High
CVE-2026-54284
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
High
CVE-2026-59893
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
High
CVE-2026-71491
sqlparse: Quadratic O(n²) DoS in group_comments
Medium
CVE-2026-53708
ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
Medium
CVE-2026-59894
sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes
High
CVE-2026-55071
MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`
High
CVE-2026-73568
libp2p: yamux connection DoS via oversized data frame
Medium
CVE-2026-9318
tablib: Stored XSS in the HTML export via unescaped dataset title
High
CVE-2026-73498
mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment
High
CVE-2026-73622
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
High
CVE-2026-73625
GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
Medium
CVE-2026-59242
Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guar
High
CVE-2026-67422
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
Medium
CVE-2026-70484
Open WebUI: Users denied the image-generation permission can still generate images via chat completions
Medium
CVE-2026-70481
Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
High
CVE-2026-70646
aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler
Medium
CVE-2026-54785
gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.