Low
CVE-2026-12798
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,330
Reset filters
Medium
CVE-2026-12795
LiteLLM: SSO Debug Flow Has Improper Authentication
Critical
CVE-2026-56315
PickleScan has multiple stdlib modules with direct RCE not in blocklist
Low
CVE-2026-12772
LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration
Low
CVE-2026-12770
LiteLLM: Admin Key Handler Has Improper Authorization
High
CVE-2025-71365
Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval
High
CVE-2025-71370
Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper
Medium
CVE-2025-71351
Picklescan missing detection when calling built-in python library function timeit.timeit()
High
CVE-2025-71376
Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions
High
CVE-2025-71341
Picklescan has a missing detection when calling built-in python profile.Profile.runctx
Medium
CVE-2026-102830
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
Medium
CVE-2026-102904
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs
High
CVE-2026-102831
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
High
CVE-2026-102925
virtualenv bash and fish activation scripts execute commands embedded in paths
High
CVE-2026-102937
Command injection via --prompt in activate.bat (batch activator)
High
CVE-2026-102930
Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
Medium
CVE-2026-102938
virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
Medium
CVE-2026-103261
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
High
CVE-2026-103262
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
High
CVE-2026-103263
Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
Medium
CVE-2026-100689
GitPython submodule update path traversal can write outside the repository
Medium
CVE-2026-81930
Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}.sno
Medium
CVE-2026-81914
Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that del
Medium
CVE-2026-102275
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.