High
CVE-2026-55514
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,855
Reset filters
Critical
CVE-2026-57571
Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE
Medium
CVE-2026-55646
vLLM: Speech-to-text upload size limit is enforced after full UploadFile read
High
CVE-2026-54060
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
High
CVE-2026-54059
Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
Medium
CVE-2026-55798
Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
High
CVE-2026-55379
Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
High
CVE-2026-55380
Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`
High
CVE-2026-49297
Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing API directly to a destination filesystem pa
High
CVE-2026-24012
Uncontrolled Resource Consumption vulnerability in Apache IoTDB.
Critical
CVE-2026-24014
Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port i
Critical
CVE-2026-24013
Authentication Bypass by Spoofing vulnerability in Apache IoTDB.
High
CVE-2022-37189
MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)
Medium
CVE-2022-2806
sosreport Exposure of Sensitive Information vulnerability
Medium
CVE-2022-1930
Regular expression denial of service in eth-account
High
CVE-2022-23451
Barbican authorization flaw before v14.0.0
Medium
CVE-2022-23452
openstack-barbican Denial of Service vulnerability
High
CVE-2022-38362
Remote code execution in Apache Airflow Docker's Provider
High
CVE-2022-31116
Incorrect handling of invalid surrogate pair characters
High
CVE-2022-35920
sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs
Medium
CVE-2018-25045
Django REST framework XSS Vulnerability
Medium
CVE-2022-31153
OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli
Low
CVE-2022-2822
OctoPrint does not have rate limiting on the login page
Low
CVE-2022-37394
OpenStack Nova Changing vnic_type breaks compute service restart
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.