Medium
CVE-2026-32111
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 685
Reset filters
High
CVE-2025-69196
FastMCP OAuth Proxy token reuse across MCP servers
Medium
CVE-2026-25960
vLLM has SSRF Protection Bypass
High
CVE-2026-27826
MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers
Low
CVE-2026-29790
dbt-common's commonprefix() doesn't protect against path traversal
High
CVE-2026-27905
BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction
Medium
CVE-2026-27695
zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service
Medium
CVE-2025-65995
Apache Airflow error reporting may expose full kwargs
High
CVE-2026-26331
yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
High
CVE-2026-2033
MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability
Medium
CVE-2026-27025
pypdf has possible long runtimes/large memory usage for large /ToUnicode streams
High
CVE-2026-1669
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
High
CVE-2026-25577
Emmett-Core: Unhandled CookieError Exception Causing Denial of Service
High
CVE-2026-1707
pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability
High
CVE-2026-56259
Crawl4AI: LLM credential exfiltration in Docker server via request base_url and env: token resolution
High
CVE-2026-73496
mcp-atlassian: Arbitrary server-side file read via attachment upload
Medium
ghsa-9mqm-qcwf-5qhg
CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources
Medium
ghsa-mxwc-wh95-pw4g
Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler
High
CVE-2026-59939
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
High
CVE-2026-59925
Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
Medium
CVE-2026-59929
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
Medium
CVE-2026-59927
Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
High
CVE-2026-59922
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
Low
CVE-2026-14966
BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.