Critical
CVE-2026-55209
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-59893
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
High
CVE-2026-71491
sqlparse: Quadratic O(n²) DoS in group_comments
Medium
CVE-2026-70657
Copyparty vulnerable to file/dirkey confusion
Medium
CVE-2026-68923
MobSF's CSRF checks not enforced after Django migration
Medium
CVE-2026-68520
Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
Medium
CVE-2026-53708
ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
High
CVE-2026-68519
Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)
Medium
CVE-2026-73559
vLLM: Completion prompt lists fan out into unbounded engine requests
Medium
CVE-2026-59894
sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes
High
CVE-2026-68518
Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction
Medium
CVE-2026-68517
Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard
High
CVE-2026-62982
Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection
High
CVE-2026-55071
MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`
High
CVE-2026-55074
Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)
Medium
CVE-2026-73416
JupyterLab: PyPI extension blocklist package-name canonicalization bypass
High
CVE-2026-73415
JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
High
CVE-2026-73417
JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
High
CVE-2026-73568
libp2p: yamux connection DoS via oversized data frame
High
CVE-2026-73652
vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review
Medium
CVE-2026-9318
tablib: Stored XSS in the HTML export via unescaped dataset title
Critical
CVE-2026-64825
Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding
Critical
CVE-2026-61459
mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials
High
CVE-2026-52776
compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.