High
CVE-2026-46606
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
Medium
CVE-2026-55837
dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
High
CVE-2026-46608
Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
Medium
CVE-2026-55865
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
High
CVE-2026-54499
Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders
Low
CVE-2026-54711
PGHoard: Password written to debug log
High
CVE-2026-23879
py7zr: Arbitrary File Write Vulnerability
High
CVE-2026-54528
jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
High
CVE-2026-12530
Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
High
CVE-2026-54695
Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID
High
CVE-2025-26240
pdfkit: Path traversal in from_string
Medium
CVE-2026-54386
marimo contains a reflected cross-site scripting vulnerability in the notebook page
Medium
CVE-2026-55748
OpenStack Horizon RC file generation does not escape special characters in project names
High
CVE-2026-53869
Hermes Agent contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation
Medium
CVE-2026-53870
Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)
Low
CVE-2026-12567
BBOT: Symlink-Following Arbitrary Write via github_workflows Module
Medium
CVE-2026-12568
BBOT: Arbitrary File Write in postman_download Module
Medium
CVE-2026-12565
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
Low
CVE-2026-12566
BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing
High
CVE-2026-54008
Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
High
CVE-2026-54010
Open WebUI: Forged chat-file link allows cross-user file read and deletion
High
CVE-2026-54012
Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
High
CVE-2026-54011
Open WebUI: Stored XSS in Mermaid Markdown Preview
High
CVE-2026-54013
Open WebUI: Stored XSS to Account Takeover via Model Profile Images
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.