Critical
CVE-2026-47103
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 452
Reset filters
Critical
CVE-2026-57125
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
Medium
ghsa-g75f-g53v-794x
Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning
Medium
CVE-2026-91992
Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse
High
CVE-2026-11816
Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filt
Critical
CVE-2026-45758
Malicious code in guardrails-ai 0.10.1 (supply chain compromise)
High
CVE-2026-5241
huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path
Medium
CVE-2026-8643
pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory
Critical
CVE-2026-47410
praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset
Critical
CVE-2026-47391
PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
High
CVE-2026-47398
PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334
Critical
CVE-2026-76242
stigmem-node's federation peer registration lacked explicit out-of-band approval
High
CVE-2026-76241
stigmem-node's unsigned plugin override could be enabled without a second explicit acknowledgment
Critical
CVE-2026-76244
stigmem-node's federation insecure transport settings may allow non-loopback cleartext federation
High
CVE-2026-76240
stigmem-node's Postgres schema identifier handling required defensive quoting
High
CVE-2026-76245
stigmem-node's federation peer token timestamp validation may reject valid peer tokens
Critical
CVE-2026-76243
stigmem-node: Auth-disabled deployments may grant broad anonymous access outside loopback
Medium
CVE-2026-48523
PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys
High
CVE-2026-44346
Dockerfile command injection via envs[*].name in bentofile.yaml (sibling fix-bypass of CVE-2026-33744 and CVE-2026-35043)
Medium
CVE-2026-44353
Streamlink has an arbitrary local file read via file:// URI in HLS and DASH
Medium
CVE-2026-44897
Mistune Heading ID Attribute has Injection XSS
Critical
ghsa-wx9m-wx4f-4cmg
Malicious dropper in mistralai 2.4.6 PyPI package
High
CVE-2026-44513
Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components
Medium
CVE-2026-42314
PyLoad Vulnerable to Path Traversal via Package Folder Name
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.