Unrated
pysec-2026-583
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-12560
Editorial Rating <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Link URL' Field
Medium
CVE-2026-12349
Premium Addons for KingComposer <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Custom Sidebar Creation and Deletion via 'add_custom_sidebar' and 'remove_custom_sidebar' AJAX actions
Medium
CVE-2026-11367
PixMagix <= 1.7.2 - Authenticated (Author+) Path Traversal in 'layers[].id' Parameter
Medium
CVE-2026-8944
Plugin for Google Analytics by IO technologies <= 1.1 - Cross-Site Request Forgery via 'ga_id' Parameter
Unrated
pysec-2026-582
Malicious code in mflux-streamlit (PyPI)
Unrated
pysec-2026-585
Malicious code in spateo-release (PyPI)
Unrated
pysec-2026-581
Malicious code in dynamo-release (PyPI)
Medium
CVE-2026-12114
Team Members <= 8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_css' Parameter
Critical
CVE-2026-48039
Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token
Critical
CVE-2026-44727
Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP
Critical
CVE-2026-53753
Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
Critical
CVE-2026-49468
LiteLLM: Authentication Bypass via Host Header Injection
Critical
CVE-2025-64712
Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write
Critical
CVE-2026-22778
vLLM has RCE In Video Processing
Critical
CVE-2026-2635
MLflow Use of Default Password Authentication Bypass Vulnerability
Critical
CVE-2026-47393
PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default
Critical
CVE-2026-2611
MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution
Critical
CVE-2026-31233
Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism
Critical
CVE-2026-45829
ChromaDB Python project has a pre-authentication code injection vulnerability
Critical
CVE-2026-25879
Langroid has Prompt to SQL Injection, Leading to RCE
Critical
CVE-2026-42601
ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView
Critical
CVE-2026-8838
amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection
Critical
CVE-2026-7813
pgAdmin 4 server mode has an authorization vulnerability affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.