Medium
CVE-2026-75597
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 58
Reset filters
High
CVE-2026-104851
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
Critical
ghsa-jqmf-mx4f-hfr6
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
High
CVE-2026-57170
Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
Critical
CVE-2026-37004
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
High
CVE-2026-54757
Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
High
CVE-2026-53964
Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
High
ghsa-vwf3-4xxj-qg6h
mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment
High
CVE-2026-54654
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field
High
CVE-2026-54655
`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator
High
CVE-2026-54656
`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data
High
CVE-2026-54621
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description
High
CVE-2026-48060
Litestar has HTML Injection Through its CSRF Token
High
CVE-2026-46439
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
High
CVE-2026-44209
banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI
Medium
CVE-2026-40602
Home Assistant Command-line Interface: Handling of user-supplied Jinja2 templates
Medium
CVE-2026-40320
Giskard has Unsandboxed Jinja2 Template Rendering in ConformityCheck
High
CVE-2026-39891
PraisonAI has Template Injection in Agent Tool Definitions
Medium
CVE-2026-40112
PraisonAI Vulnerable to Stored XSS via Unsanitized Agent Output in HTML Rendering (nh3 Not a Required Dependency)
High
CVE-2026-34172
Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment
Low
CVE-2026-2969
datapizza-ai: Server-Side Template Injection in ChatPromptTemplate via Jinja2 Template Handler
High
CVE-2025-65106
LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates
Low
CVE-2025-6518
pyspur Incomplete Filtering of Special Elements allowed by SingleLLMCallNode function
Medium
CVE-2025-48944
vLLM Tool Schema allows DoS via Malformed pattern and type Fields
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.