Critical
CVE-2026-47413
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 185
Reset filters
Low
CVE-2026-45426
Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against D
Critical
CVE-2026-47416
praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}
Critical
CVE-2026-47410
praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset
Critical
CVE-2026-47391
PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
Medium
CVE-2026-47395
PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
Medium
CVE-2026-47390
PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
High
CVE-2026-48526
PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
Medium
CVE-2026-48523
PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys
Medium
CVE-2026-23679
libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface clai
Critical
CVE-2026-46695
BoxLite: Permission Bypass Allows Modification of Read-Only Files
High
ghsa-mw8f-w6p8-xrf4
wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None
High
CVE-2026-56398
Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
High
CVE-2026-42266
JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
Critical
CVE-2026-42864
FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft
Low
CVE-2026-7808
Multiple security fixes in justhtml
Critical
CVE-2026-40258
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
Medium
CVE-2026-39373
JWCrypto: JWE ZIP decompression bomb
High
CVE-2026-33175
Auth0OAuthenticator has an Authentication Bypass via Unverified Email Claims
High
CVE-2026-32727
SciTokens has an Authorization Bypass via Path Traversal in Scope Validation
High
CVE-2026-28490
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
High
CVE-2026-28498
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
Critical
CVE-2026-27962
Authlib JWS JWK Header Injection: Signature Verification Bypass
High
CVE-2026-28802
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.