High
CVE-2026-32609
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,358
Reset filters
High
CVE-2026-32608
Glances has a Command Injection via Process Names in Action Command Templates
High
CVE-2026-32596
Glances exposes the REST API without authentication
High
CVE-2026-30922
Denial of Service in pyasn1 via Unbounded Recursion
High
CVE-2026-28500
ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
Low
CVE-2026-27448
pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback
Critical
Exploited in attacks
CVE-2026-33017
Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint
Medium
CVE-2026-28563
Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dep
High
CVE-2026-30911
Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve,
High
CVE-2026-28779
Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the configured [webserver] base_url or [api] base_url.
Medium
CVE-2026-26929
Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a
High
CVE-2026-28490
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
High
CVE-2026-28498
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
Critical
CVE-2026-32633
Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`
Critical
CVE-2026-27962
Authlib JWS JWK Header Injection: Signature Verification Bypass
High
CVE-2026-32640
SimpleEval: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox
Medium
ghsa-5cxw-w2xg-2m8h
fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE`
Medium
ghsa-r48f-3986-4f9c
fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist
High
CVE-2026-105782
Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
High
CVE-2026-32597
PyJWT accepts unknown `crit` header extensions
High
CVE-2026-31899
CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification
High
CVE-2026-21887
OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature
Low
CVE-2026-32109
Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html`
Low
CVE-2026-32108
Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.