Low
CVE-2026-59226
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-59220
Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config
Low
CVE-2026-59715
Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)
High
CVE-2026-59219
Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
Low
CVE-2026-59213
Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)
Medium
CVE-2026-13769
AWS CLI: Overly permissive File Permissions
Medium
CVE-2026-61632
PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
High
CVE-2026-59214
Open WebUI: Stored web worker XSS via Pyodide
Medium
CVE-2026-59218
Open WebUI: Account enumeration via observable login timing discrepancy
Medium
CVE-2026-59938
pypdf: Possible large memory usage for wrong image dimensions
High
CVE-2026-59936
pypdf: Possible infinite loop for not terminated inline images
Low
CVE-2026-63632
ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape
Medium
CVE-2026-49138
Nanobot contains a server-side request forgery vulnerability in the web_fetch tool
Low
CVE-2026-11466
zilliztech deep-searcher has an Incorrect Privilege Assignment issue
Medium
CVE-2026-59937
pypdf: Possible long runtimes for repeated malformed cross-reference entries
Low
CVE-2026-11529
MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler
High
CVE-2026-59935
pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
Medium
CVE-2026-52902
awxkit has a path traversal vulnerability
Medium
CVE-2026-10221
hermes-agent has an Injection issue
Medium
CVE-2026-10224
hermes-agent has an Uncontrolled Resource Consumption issue
Low
CVE-2026-10223
hermes-agent has an Injection issue
Medium
CVE-2026-14317
GiveWP – Donation Plugin and Fundraising Platform < 4.16.3 - Unauthenticated Payment Bypass
Medium
CVE-2026-14830
FlxWoo < 3.1.1 - Unauthenticated Payment Bypass
Medium
CVE-2026-17017
CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.