Medium
CVE-2026-54386
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 737
Reset filters
Medium
CVE-2026-53870
Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)
High
CVE-2026-54008
Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
High
CVE-2026-54012
Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
High
CVE-2026-54011
Open WebUI: Stored XSS in Mermaid Markdown Preview
High
CVE-2026-54013
Open WebUI: Stored XSS to Account Takeover via Model Profile Images
High
CVE-2026-54017
Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
Medium
CVE-2026-54019
Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode
Medium
CVE-2026-54014
Open WebUI: Sibling-Prefix Path Traversal via /cache/{path}
High
CVE-2026-50023
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
Medium
CVE-2026-54006
Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar
Medium
CVE-2026-42867
Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint
Medium
CVE-2026-48053
Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset
High
CVE-2026-48060
Litestar has HTML Injection Through its CSRF Token
High
CVE-2026-47419
praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR
High
CVE-2026-44019
Docling Core: Insufficient validation of image reference URIs
High
CVE-2026-47418
praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR
High
CVE-2026-47417
praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR
High
CVE-2026-46439
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
Medium
CVE-2026-45774
compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal
High
CVE-2026-45725
compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal
Medium
CVE-2026-47157
aiograpi: Unsafe signup challenge path handling
Medium
CVE-2026-8597
Amazon SageMaker Python SDK is missing integrity verification in its Triton inference handler
High
CVE-2026-46432
LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.