Medium
CVE-2023-54358
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Critical
CVE-2026-40088
PraisonAI Vulnerable to OS Command Injection
Critical
Exploited in attacks
CVE-2026-39987
Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
High
ghsa-5478-66c3-rhxr
Pretext: Algorithmic Complexity (DoS) in the text analysis phase
Medium
CVE-2026-39892
Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs
Medium
CVE-2026-39844
NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
High
CVE-2026-39983
basic-ftp has FTP Command Injection via CRLF
High
CVE-2026-39976
Laravel Passport: TokenGuard Authenticates Unrelated User for Client Credentials Tokens
High
CVE-2026-39974
n8n-mcp has authenticated SSRF via instance-URL header in multi-tenant HTTP mode
High
CVE-2026-39959
Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service
High
CVE-2026-39885
mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
Critical
CVE-2026-39888
PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
Critical
CVE-2026-39890
PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading
High
CVE-2026-39394
CI4MS Vulnerable to .env CRLF Injection via Unvalidated `host` Parameter in Install Controller
High
CVE-2026-39393
CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass
Medium
CVE-2026-39392
CI4MS has stored XSS in Pages Content Due to Missing html_purify Sanitization
Medium
CVE-2026-39391
CI4MS has stored XSS via Unescaped Blacklist Note in Admin User List
Medium
CVE-2026-39390
CI4MS has stored XSS via srcdoc attribute bypass in Google Maps iframe setting
Medium
CVE-2026-39389
CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files
Medium
CVE-2026-40180
quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class
Unrated
CVE-2026-6095
drupal/orejime - SA-CONTRIB-2026-032
Medium
CVE-2026-39865
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
Medium
CVE-2026-5600
A new API endpoint introduced in pretix 2025 that is supposed to
Medium
CVE-2026-82853
Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.