High
CVE-2026-48802
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,404
Medium
CVE-2026-55163
Lemur Privilege Escalation: Non-admin role members can rewrite role membership via PUT /api/1/roles/<id>
Medium
CVE-2026-55165
Lemur: JWT verifier honors attacker-supplied alg, enabling ATO
High
CVE-2026-48508
Lemur has an authorization bypass in StrictRolePermission / AuthorityCreatorPermission
Medium
CVE-2026-55162
Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF
Medium
CVE-2026-55164
Lemur user-update path stores plaintext passwords
Medium
CVE-2026-48990
joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization
High
CVE-2026-48813
Flawfinder output manipulation via untrusted filenames and source text
Medium
CVE-2026-35163
OctoPrint has XSS in its Suppressed Command Notifications
Medium
CVE-2026-55863
motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution
High
CVE-2026-55488
motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read
High
CVE-2026-53925
Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
High
CVE-2026-54134
OctoPrint has possible file exfiltration via query parameters on upload endpoints
Medium
CVE-2026-48487
zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet
Medium
CVE-2026-48775
LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading
High
CVE-2026-9291
amazon-braket-sdk vulnerable to Insecure Deserialization via pickle.loads()
Medium
CVE-2026-31978
motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint
Medium
CVE-2026-32315
motionEye's World-Readable Configuration File Exposes Admin Password Hash
High
CVE-2025-67303
ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)
Medium
CVE-2026-55206
py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()
Medium
CVE-2026-55195
py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size
Medium
CVE-2026-46611
Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
High
CVE-2026-46607
Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution
High
CVE-2026-46606
Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.