Critical
CVE-2026-40525
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Critical
CVE-2026-0545
mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization
Critical
CVE-2026-38360
dash-uploader has a directory traversal vulnerability
Critical
CVE-2026-35030
LiteLLM: Authentication bypass via OIDC userinfo cache key collision
Critical
CVE-2025-57735
Apache Airflow: JWT token still valid after logout
Critical
CVE-2025-15036
MLFlow path traversal vulnerability
Critical
CVE-2025-15379
MLflow Command Injection vulnerability
Critical
Exploited in attacks
CVE-2026-42208
LiteLLM has SQL Injection in Proxy API key verification
Critical
CVE-2026-32871
FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
Critical
CVE-2023-43654
TorchServe Server-Side Request Forgery vulnerability
Critical
CVE-2023-6019
Ray OS Command Injection vulnerability
Critical
CVE-2023-48022
Ray has arbitrary code execution via jobs submission API
Critical
CVE-2023-6020
Ray Missing Authorization vulnerability
Critical
CVE-2023-6021
Ray Path Traversal vulnerability
Critical
CVE-2023-45853
pyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency
Critical
CVE-2023-32321
Ckan remote code execution and private information access via crafted resource ids
Critical
CVE-2022-37454
Buffer overflow in sponge queue functions
Critical
CVE-2024-21669
Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC
Critical
CVE-2023-50447
Arbitrary Code Execution in Pillow
Critical
CVE-2024-0521
Code Injection in paddlepaddle
Critical
CVE-2024-5751
litellm vulnerable to remote code execution based on using eval unsafely
Critical
CVE-2024-34359
llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata
Critical
CVE-2024-32651
changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
Critical
CVE-2024-35198
TorchServe vulnerable to bypass of allowed_urls configuration
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.