Medium
CVE-2026-40491
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,861
Reset filters
High
CVE-2026-41496
PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)
Critical
CVE-2026-41497
PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection
Critical
CVE-2026-27197
Sentry: Improper authentication on SAML SSO process allows user identity linking
High
CVE-2026-31987
Apache Airflow: JWT token appearing in logs
High
CVE-2025-54550
Apache Airflow: RCE by race condition in example_xcom dag
Medium
CVE-2026-41182
LangSmith SDK: Streaming token events bypass output redaction
High
CVE-2026-40192
FITS GZIP decompression bomb in Pillow
Medium
CVE-2026-40256
Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision
Medium
CVE-2026-39845
Weblate: SSRF via the webhook add-on using unprotected fetch_url()
High
CVE-2026-34393
Weblate: Privilege escalation in the user API endpoint
High
CVE-2026-34242
Weblate: Arbitrary File Read via Symlink
Medium
CVE-2026-34244
Weblate: SSRF via Project-Level Machinery Configuration
Medium
CVE-2026-33440
Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads
High
CVE-2026-33435
Weblate: Remote code execution during backup restoration
Medium
CVE-2026-33220
Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
Critical
CVE-2026-30625
Upsonic: remote code execution vulnerability in its MCP server/task creation functionality
Medium
CVE-2026-33214
Weblate: Improper access control for the translation memory in API
Low
CVE-2026-33212
Weblate: Improper access control for pending tasks in API
Medium
CVE-2026-25219
Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access
Low
ghsa-fj52-5g4h-gmq8
pyLoad's Session Not Invalidated After Permission Changes
Low
CVE-2026-7808
Multiple security fixes in justhtml
Critical
CVE-2026-40576
excel-mcp-server has a Path Traversal issue
High
CVE-2026-33858
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly tru
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.