Critical
CVE-2026-1709
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,861
Reset filters
Medium
CVE-2026-25516
NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
High
CVE-2026-25732
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
Critical
ghsa-4f84-67cv-qrv3
A single post-release of dydx-v4-client contained obfuscated multi-stage loader
High
CVE-2026-25640
Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL
Critical
CVE-2026-25592
Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK
High
CVE-2026-25580
Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling
Critical
CVE-2026-25632
EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)
Medium
CVE-2026-1312
Django has an SQL Injection issue
High
CVE-2026-1287
Django has an SQL Injection issue
High
CVE-2026-1207
Django has an SQL Injection issue
Low
CVE-2026-1285
Django has Inefficient Algorithmic Complexity
Low
CVE-2025-14550
Django has Inefficient Algorithmic Complexity
Low
CVE-2025-13473
Django has Observable Timing Discrepancy
Medium
CVE-2025-70960
A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
Medium
CVE-2025-70959
A stored cross-site scripting (XSS) vulnerability in the Jobs module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
Critical
CVE-2026-25505
Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication
Critical
CVE-2026-25481
Langroid has WAF Bypass Leading to RCE in TableChatAgent
Critical
CVE-2024-5986
H2O has an External Control of File Name or Path vulnerability
Medium
CVE-2020-37044
OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can inject arbitrary JavaScript code by sending a crafted GET request with a malicio
High
CVE-2020-37041
OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary files from the filesystem by sending crafted GET requests with p
High
CVE-2025-69662
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
Critical
CVE-2026-25130
CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection
Critical
CVE-2026-40035
Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.