Medium
CVE-2026-46556
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,404
High
CVE-2026-4137
MLFlow Creates a Temporary File With Insecure Permissions
Medium
CVE-2026-46338
Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path
High
CVE-2026-48989
Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS
Medium
CVE-2026-46486
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
High
CVE-2025-51427
ModelScope is vulnerable to arbitrary code injection via a crafted module
Medium
CVE-2026-45554
NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes
High
CVE-2026-46432
LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization
High
CVE-2026-45804
Diffusers: TOCTOU Trust Remote Code Bypass
High
CVE-2026-27173
Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments
High
CVE-2026-45370
python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection
High
CVE-2026-44716
Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator
High
CVE-2026-45675
Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts
High
CVE-2026-45553
NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()
Medium
CVE-2026-45106
Weblate: Stored HTML injection in editor search preview
High
CVE-2026-45672
Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
High
CVE-2026-45727
CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion
Medium
CVE-2026-46383
Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`
Low
CVE-2026-8754
AstrBot: File upload vulnerability in the function post_file of the file astrbot/dashboard/routes/chat.py
High
CVE-2026-45539
Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree
High
CVE-2026-45671
Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion
Medium
CVE-2026-45365
Open WebUI: Authenticated users can bypass model access control via exposed query parameter [AI-ASSISTED]
High
CVE-2026-45401
Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)
Medium
CVE-2026-45396
Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.