High
CVE-2026-50180
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 685
Reset filters
Low
CVE-2026-3408
Open Babel has a NULL pointer dereference in CDXML OBAtom::GetExplicitValence
High
CVE-2026-49291
mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call
Low
CVE-2026-2704
Open Babel has an out-of-bounds read in CIF transform3d::DescribeAsString
Low
CVE-2026-2705
Open Babel has NULL pointer dereference in MOL2 OBAtom::SetFormalCharge
Medium
CVE-2026-55162
Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF
Medium
CVE-2026-48990
joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization
Medium
CVE-2026-35163
OctoPrint has XSS in its Suppressed Command Notifications
Medium
CVE-2026-48487
zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet
Medium
CVE-2026-32315
motionEye's World-Readable Configuration File Exposes Admin Password Hash
Medium
CVE-2026-55206
py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()
Medium
CVE-2026-55195
py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size
High
CVE-2026-46606
Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
High
CVE-2026-23879
py7zr: Arbitrary File Write Vulnerability
High
CVE-2026-54695
Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID
Medium
CVE-2026-12565
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
High
CVE-2026-54012
Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
Medium
CVE-2026-54016
Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration
Medium
CVE-2026-54022
Open WebUI: Any authenticated user can read other users' private notes via Socket.IO
High
CVE-2026-50023
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
Medium
CVE-2026-50019
yt-dlp: File Downloader cookie leak with curl
High
CVE-2026-50574
yt-dlp: Arbitrary code execution via manifest downloads with aria2c
Low
CVE-2026-53537
python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
Medium
CVE-2026-54530
pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.