Medium
CVE-2026-107292
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,404
High
CVE-2026-107295
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
Low
CVE-2026-107293
Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`
Medium
CVE-2026-107294
Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl
Medium
CVE-2026-107228
AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)
Medium
CVE-2026-107226
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS
High
CVE-2026-107227
AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled
High
CVE-2026-107230
AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins
High
CVE-2026-61443
PraisonAI: SkillTools Executes Scripts Without Path Containment Validation
High
CVE-2026-61437
PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow
Medium
CVE-2026-61432
PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace
Medium
CVE-2026-107290
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
Low
CVE-2026-107291
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Medium
CVE-2026-107289
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
High
CVE-2026-61446
PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification
Critical
CVE-2026-61447
PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets
Medium
CVE-2026-60087
PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments
High
CVE-2026-61430
PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure
Medium
CVE-2026-60089
PraisonAI: Project config can auto-save agent output outside the project root
Low
CVE-2026-107283
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
Medium
CVE-2026-107285
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
Medium
CVE-2026-107280
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
Critical
CVE-2026-107282
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
High
CVE-2026-107231
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.