Medium
CVE-2026-73556
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,330
Reset filters
Medium
CVE-2026-73557
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
Critical
CVE-2026-71428
unstructured: Server-Side Request Forgery in the URL-based partitioning
Medium
CVE-2026-84305
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
High
CVE-2026-84366
Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default
Critical
CVE-2026-62674
Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE
Medium
CVE-2026-71492
Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root
Medium
CVE-2026-73228
Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`
High
CVE-2026-55485
piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
Medium
CVE-2026-54553
Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
Medium
CVE-2026-54770
WebOb: Open redirect in Location header normalization via leading C0 control / space characters
Critical
CVE-2026-54569
senaite.core Vulnerable to Eval Injection and Missing Authorization
Medium
CVE-2026-55558
aiosmtplib: STARTTLS response injection
High
CVE-2026-54591
asyncssh has SCP Path Traversal to Arbitrary File Write
Medium
CVE-2026-54590
asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution
Critical
CVE-2026-55640
nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
High
CVE-2026-55585
qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`
Medium
CVE-2026-55419
reachy_mini Allows Unrestricted Upload of File with Dangerous Type
Medium
CVE-2026-55619
eml_parser has parser DoS via deeply nested parentheses in e-mail headers
Critical
CVE-2026-45018
Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution
High
CVE-2026-45019
Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access
Critical
CVE-2026-55546
qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input
High
CVE-2026-55539
PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete
Critical
CVE-2026-55536
PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.