High
CVE-2026-80047
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 54
Reset filters
Critical
CVE-2026-68770
sentence-transformers local model loading bypasses trust_remote_code and executes custom Python
Critical
CVE-2026-61732
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
High
CVE-2026-84452
Windows ML CLI: CORS misconfig enables localhost RCE
Medium
CVE-2026-73560
vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections
Critical
CVE-2026-61539
Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing
High
CVE-2026-9856
Transformers save_pretrained path traversal allows arbitrary file writes through chat template names
Critical
CVE-2026-50027
mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete
Critical
CVE-2026-47117
OpenMed vulnerable to remote code injection through privacy-filter model loading path
High
CVE-2026-46517
lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out
High
CVE-2026-46432
LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization
High
CVE-2026-45804
Diffusers: TOCTOU Trust Remote Code Bypass
Medium
CVE-2026-45397
Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure
Medium
CVE-2026-7669
SGLang has an Improper Input Validation/Injection Issue
High
CVE-2026-22807
vLLM affected by RCE via auto_map dynamic module loading during model initialization
High
CVE-2025-66448
vLLM vulnerable to remote code execution via transformers_utils/get_config
Medium
CVE-2025-6051
Hugging Face Transformers library has Regular Expression Denial of Service
Medium
CVE-2025-6921
Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer
Medium
CVE-2025-6638
Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
Medium
CVE-2025-5197
Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability
Medium
CVE-2025-3933
Transformers is vulnerable to ReDoS attack through its DonutProcessor class
Low
CVE-2025-3777
Transformers's Improper Input Validation vulnerability can be exploited through username injection
Medium
CVE-2025-3263
Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking
Medium
CVE-2025-3264
Transformers vulnerable to ReDoS attack through its get_imports() function
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.