High
CVE-2026-97687
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 24
Reset filters
Medium
CVE-2026-103261
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
Medium
CVE-2026-71486
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
High
CVE-2026-82397
Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
High
CVE-2026-54447
garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store
High
CVE-2026-54071
BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py
High
CVE-2022-46280
Open Babel has uninitialized pointer dereference in PQS pFormat
High
CVE-2022-43467
Open Babel has out-of-bounds write in PQS coord_file parser
Medium
CVE-2025-11000
Open Babel has out-of-bounds read in PQS lowerit (pre-buffer read)
Medium
CVE-2026-31978
motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint
High
CVE-2026-45338
Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)
Medium
CVE-2026-40214
OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer
Medium
CVE-2025-61912
python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination
Low
CVE-2025-58161
MobSF Path Traversal in GET /download/<filename> using absolute filenames
High
CVE-2026-42304
Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
Medium
CVE-2026-27482
Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
High
CVE-2025-64496
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
Medium
CVE-2023-49793
CodeChecker has a Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store`
High
ghsa-hvh4-5qr6-3v7r
Observable Timing Discrepancy in pypqc
Critical
CVE-2023-31543
A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.
Medium
CVE-2022-23485
Sentry vulnerable to invite code reuse via cookie manipulation
Critical
CVE-2019-17134
OpenStack Octavia Amphora-Agent not requiring Client-Certificate
Medium
CVE-2015-2674
Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap_socket function in Python with the default CERT_NONE value for the cert_reqs argument.
Medium
CVE-2022-21690
OTF-001: Improper Input Sanitation: The path parameter of the requested URL is not sanitized before being passed to the QT frontend
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.