High
CVE-2026-59219
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,999
Reset filters
Low
CVE-2026-59213
Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)
Medium
CVE-2026-61632
PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
High
CVE-2026-59214
Open WebUI: Stored web worker XSS via Pyodide
Medium
CVE-2026-59218
Open WebUI: Account enumeration via observable login timing discrepancy
Medium
CVE-2026-49138
Nanobot contains a server-side request forgery vulnerability in the web_fetch tool
Low
CVE-2026-11529
MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler
High
CVE-2026-69097
GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
Medium
ghsa-wchh-9x6h-7f6p
olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193
High
CVE-2026-59200
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
High
CVE-2026-59204
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
High
Exploited in attacks
CVE-2026-59822
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
High
CVE-2026-54058
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
Medium
CVE-2026-59198
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
High
CVE-2026-54549
meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch
High
CVE-2026-54547
meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
High
CVE-2026-54567
Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)
Critical
CVE-2026-61740
LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
Critical
CVE-2026-61736
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
High
CVE-2026-54234
vLLM has Remote DoS via Invalid Recovered Token Reinjection
High
CVE-2026-59950
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
High
CVE-2026-52870
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
High
CVE-2026-52869
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
High
CVE-2026-50271
dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.