Medium
CVE-2026-49461
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 685
Reset filters
Medium
CVE-2026-48155
pypdf: Possible large memory usage for large offsets for layout mode text
Medium
CVE-2026-47763
PDM: Project-Local State and Config Writes Follow Symlinks
Low
CVE-2026-47715
Bugsink: Issue event views can show an event from another project if its UUID is known
High
CVE-2026-47419
praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR
Medium
CVE-2026-43980
malla: Stored XSS via Meshtastic node names in multiple frontend pages
High
CVE-2026-47415
praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR
High
CVE-2026-47417
praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR
High
CVE-2026-47397
PraisonAI has an Arbitrary File Write in Python API
High
CVE-2026-48169
PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API
Medium
CVE-2026-47408
praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership
High
CVE-2026-47394
PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate
Medium
CVE-2026-47183
zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion
Medium
CVE-2026-47184
zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood
Medium
CVE-2026-47180
zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial of service
Medium
CVE-2026-46526
local-deep-research has an SSRF bypass in `safe_get`
High
CVE-2026-10105
agno contains a SQL injection vulnerability
High
CVE-2026-8596
Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path
Medium
CVE-2026-45554
NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes
High
CVE-2026-45370
python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection
Medium
CVE-2026-46383
Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`
High
CVE-2026-45539
Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree
High
CVE-2026-45400
Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`
High
CVE-2026-45399
Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.