Medium
CVE-2026-73557
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,330
Reset filters
Medium
CVE-2026-84378
HTTPX2: Quadratic SSE line buffering can cause CPU denial of service
Medium
CVE-2026-78679
GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)
High
CVE-2026-82397
Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Critical
CVE-2026-71428
unstructured: Server-Side Request Forgery in the URL-based partitioning
Medium
CVE-2026-84305
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
High
CVE-2026-84366
Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default
Medium
CVE-2026-81723
NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`
Medium
CVE-2026-12876
NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars
Medium
CVE-2026-73295
Material for MkDocs: DOM XSS in search suggestions via query parameter
Critical
CVE-2026-62674
Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE
High
CVE-2026-62677
Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE
High
CVE-2026-76098
Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
High
CVE-2026-62676
Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
High
CVE-2026-62675
Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools
High
CVE-2026-78680
NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary
Medium
CVE-2026-71492
Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root
Medium
CVE-2026-73228
Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`
High
CVE-2026-55228
Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project
High
CVE-2026-55509
WsgiDAV MySQL provider has a blind SQL injection
High
CVE-2026-55520
Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching
High
CVE-2026-55830
RestrictedPython guard hooks can be shadowed via positional-only arguments
High
CVE-2026-55485
piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.
Critical
CVE-2026-55247
plone.app.event vulnerable to denial of service via iCalendar import
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.