High
CVE-2026-23535
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,404
Medium
CVE-2026-22251
Weblate wlc has insecure API key configuration
Low
CVE-2026-22250
Weblate command-line client susceptible to SSL verification skip
Medium
CVE-2026-21860
Werkzeug safe_join() allows Windows special device names with compound extensions
Low
CVE-2026-22691
pypdf has possible long runtimes for malformed startxref
High
CVE-2026-22609
Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist
High
CVE-2026-22606
Fickling has a bypass via runpy.run_path() and runpy.run_module()
High
CVE-2026-22607
Fickling Blocklist Bypass: cProfile.run()
High
CVE-2026-22608
Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection
High
CVE-2026-22612
Fickling vulnerable to detection bypass due to "builtins" blindness
Low
CVE-2025-15506
AcademySoftwareFoundation OpenColorIO has an out-of-bounds vulnerability
Medium
CVE-2026-21872
NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
High
CVE-2026-21873
NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
Low
CVE-2026-22690
pypdf has possible long runtimes for missing /Root object with large /Size values
Medium
CVE-2026-21871
NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
Medium
CVE-2026-21874
NiceGUI has Redis connection leak via tab storage causes service degradation
Low
CVE-2025-15504
LIEF is vulnerable to segmentation fault
Medium
CVE-2025-68158
Authlib has 1-click Account Takeover vulnerability
High
CVE-2026-21441
Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
High
CVE-2026-53872
picklescan has Arbitrary file read using `io.FileIO`
Medium
CVE-2026-21892
Parsl Monitoring Visualization Vulnerable to SQL Injection
Medium
CVE-2026-21883
Bokeh server applications have Incomplete Origin Validation in WebSockets
Medium
CVE-2026-21851
MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download
Medium
CVE-2023-7333
records-mover Injection vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.