High
CVE-2026-31253
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
High
CVE-2026-31248
Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks
Medium
CVE-2026-8319
aiwaves-cn agents is vulnerable to resource consumption in the recall_relevant_memories_to_working_memory function
High
CVE-2026-7817
pgAdmin 4 contains local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities
High
CVE-2026-7816
pgAdmin 4: OS command injection vulnerability in Import/Export query export
Medium
CVE-2026-7814
pgAdmin 4: Stored cross-site scripting (XSS) vulnerability in Browser Tree and Explain Visualizer modules
High
CVE-2026-40217
LiteLLM has a sandbox escape in custom-code guardrail
Medium
CVE-2026-6420
Keylime has a hardcoded attestation challenge nonce that allows replay attacks
Medium
CVE-2026-44972
GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content
High
CVE-2026-44971
GuardDog has a blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
Medium
CVE-2026-31246
GPT-Pilot contains a command injection vulnerability in the Executor.run() method
High
CVE-2026-31247
Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks
High
CVE-2026-44340
PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
High
CVE-2026-44338
PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
Medium
CVE-2026-44337
PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries
High
CVE-2026-44569
Open WebUI's Insecure Message Access Breaks Authorization
High
CVE-2026-44570
Open WebUI has inconsistent authorization controls within memories API
High
CVE-2026-44565
Open WebUI Arbitrary File Write, Delete via Path Traversal
Medium
CVE-2026-44571
Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission
High
CVE-2026-44843
LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists
Medium
CVE-2026-44844
eml_parser has recursion DoS via nested message/rfc822 attachments
Medium
CVE-2026-44564
Read-Only Open WebUI Users Can Modify Collaborative Documents via Socket.IO
High
CVE-2026-44567
Open WebUI has Improper Authorization Control
Medium
CVE-2026-44562
Open WebUI's Model Import Overwrites Any Model Without Ownership Check
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.