Medium
CVE-2026-56304
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,530
Medium
CVE-2026-58203
pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size
High
CVE-2026-58201
Lokka: Azure Resource Manager URL path validation issue
High
CVE-2026-58200
@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing
High
CVE-2026-59152
LangSmith SDK TracingMiddleware: Arbitrary server-side file read
Medium
CVE-2026-58266
Anki: User scripts in iframes have access to the internal Anki API
Medium
CVE-2026-58198
ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer
Critical
CVE-2026-56120
OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
High
CVE-2026-58500
appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)
High
CVE-2026-58499
EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id
High
ghsa-v3f4-w7r7-v3hm
Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests
High
CVE-2026-76238
stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)
High
CVE-2026-76237
stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)
High
CVE-2026-76236
stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)
Low
CVE-2026-57481
parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change
High
CVE-2026-58485
SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`
High
CVE-2026-58483
SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`
Medium
CVE-2026-58413
Network-AI: EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data
Medium
CVE-2026-58414
Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups
Medium
CVE-2026-58482
Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
Medium
CVE-2026-58481
Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
High
CVE-2026-58484
Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning
Medium
CVE-2026-57442
MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested
Low
ghsa-h5jc-78hr-3pc9
Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.