High
CVE-2026-54446
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 682
Reset filters
High
CVE-2026-54447
garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store
High
CVE-2026-57130
PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
High
CVE-2026-57122
PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)
Critical
CVE-2026-57116
PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation
High
CVE-2026-57126
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
Medium
CVE-2026-57115
PraisonAI: SpiderTools redirect-target SSRF protection bypass
High
CVE-2026-56834
PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
High
CVE-2026-59884
pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
Medium
CVE-2026-59203
Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
High
CVE-2026-59199
Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
High
ghsa-xf7x-x43h-rpqh
json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS
Medium
CVE-2026-49836
psd-tools vulnerable to arbitrary file write via smart-object filename
Medium
CVE-2026-53720
pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small
High
CVE-2026-54071
BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py
High
CVE-2026-49477
Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser
High
CVE-2026-49476
Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists
High
CVE-2026-49825
`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes
Critical
CVE-2026-54760
Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls
Critical
CVE-2026-55615
Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879
High
CVE-2026-55787
flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf
High
CVE-2026-50180
Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read
Low
CVE-2026-3408
Open Babel has a NULL pointer dereference in CDXML OBAtom::GetExplicitValence
High
CVE-2026-49291
mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.