High
CVE-2026-40961
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 240
Reset filters
Critical
CVE-2026-47416
praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}
Medium
CVE-2026-47144
Shamefile has an arbitrary file read via shamefile.yaml in shame next
Low
CVE-2026-48524
PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
Medium
CVE-2026-44353
Streamlink has an arbitrary local file read via file:// URI in HLS and DASH
Critical
CVE-2026-46703
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
Critical
CVE-2026-46695
BoxLite: Permission Bypass Allows Modification of Read-Only Files
Medium
ghsa-g39v-cvjh-8fpf
Home Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/
High
CVE-2026-42313
pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
Medium
CVE-2026-42312
pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
Critical
CVE-2026-44336
PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection
High
ghsa-52cq-7v8r-62c6
gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense
Medium
CVE-2026-86256
wger: trainer_login open redirect - ?next= parameter not validated against host
Medium
CVE-2025-61669
Jupyter Server has an open redirection vulnerability in `next` query parameter
Medium
CVE-2026-40606
mitmproxy has an LDAP Injection
Critical
CVE-2026-40289
PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions
Critical
CVE-2026-40154
PraisonAI Vulnerable Untrusted Remote Template Code Execution
Critical
CVE-2026-39888
PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
High
ghsa-69x8-hrgq-fjj8
LiteLLM: Password hash exposure and pass-the-hash authentication bypass
High
CVE-2026-39376
FastFeedParser has an infinite redirect loop DoS via meta-refresh chain
Critical
CVE-2026-35490
changedetection.io Vulnerable to Authentication Bypass via Decorator Ordering
Critical
CVE-2026-32714
SciTokens is vulnerable to SQL Injection in KeyCache
Unrated
pysec-2026-3
Two telnyx versions published containing credential harvesting malware
High
CVE-2026-32711
pydicom has a path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.