High
CVE-2026-48169
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,404
Medium
CVE-2026-47408
praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership
High
CVE-2026-47399
PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID
High
CVE-2026-47414
praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)
High
CVE-2026-47406
praisonai-platform: IDOR in dependency endpoints allows cross-workspace issue linking, reading, and deletion due to missing ownership checks
Low
CVE-2026-10222
hermes-agent has an Injection issue
Low
CVE-2026-10212
AstrBot: Manipulation of astr_main_agent's session_id parameter leads to authorization bypass
Low
CVE-2026-10177
Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint
Low
CVE-2026-10175
Aider is vulnerable to Code Injection via editor_coder.run function
High
CVE-2026-47394
PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate
Medium
CVE-2026-47213
BoxLite has a Timeout Bypass Vulnerability
High
CVE-2026-47211
ouroboros-ai Vulnerable to Remote Code Execution via Untrusted Project-Directory .env
High
CVE-2026-10108
xiaomusic contains an unauthenticated path traversal vulnerability
Medium
CVE-2026-47183
zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion
Medium
CVE-2026-47184
zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood
Medium
CVE-2026-47180
zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial of service
Medium
CVE-2026-46380
compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem
High
CVE-2026-46439
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
Medium
CVE-2026-45774
compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal
Medium
CVE-2026-49299
OpenStack Neutron has an Incorrect Authorization issue
Medium
CVE-2026-46526
local-deep-research has an SSRF bypass in `safe_get`
High
CVE-2026-42305
Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
High
CVE-2026-42563
Dulwich Vulnerable to Command Injection via Merge Driver Path
High
CVE-2026-46345
compliance-trestle - jinja has an Arbitrary File Write via Path Traversal
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.