Medium
CVE-2026-4229
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,404
High
CVE-2026-33139
PySpector has a Plugin Sandbox Bypass leads to Arbitrary Code Execution
Medium
CVE-2026-33140
Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution
Medium
CVE-2026-3029
PyMuPDF has a path traversal in _main_.py
Medium
CVE-2026-33123
pypdf has inefficient decoding of array-based streams
Medium
CVE-2026-32889
Denial of service via non-terminating SYLT frame parsing loop in tinytag
High
CVE-2026-33125
Frigte has broken access control viewer user can delete admin and other users account
High
CVE-2026-33155
DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT
Medium
CVE-2026-4269
Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit
High
CVE-2025-14287
MLflow has a command injection in mlflow/sagemaker/__init__.py
Medium
CVE-2026-31826
pypdf: manipulated stream length values can exhaust RAM
High
CVE-2026-3989
SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization
High
CVE-2026-28356
multipart vulnerable to ReDoS in `parse_options_header()`
High
CVE-2026-32116
Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite
Medium
CVE-2026-32112
ha-mcp has XSS via Unescaped HTML in OAuth Consent Form
High
CVE-2026-32247
Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters
Medium
CVE-2026-32111
ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle
High
CVE-2025-69196
FastMCP OAuth Proxy token reuse across MCP servers
Medium
CVE-2026-31815
django-unicorn affected by component state manipulation via unvalidated attribute access
Medium
CVE-2026-25960
vLLM has SSRF Protection Bypass
Medium
CVE-2026-29787
mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint
High
CVE-2026-33010
mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft
High
CVE-2026-27826
MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers
Medium
CVE-2026-25604
Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.