Critical
CVE-2026-48519
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 685
Reset filters
Medium
CVE-2026-48520
Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read
Medium
CVE-2026-54276
aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges
High
CVE-2026-59152
LangSmith SDK TracingMiddleware: Arbitrary server-side file read
Medium
CVE-2026-58198
ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer
High
CVE-2026-58499
EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id
Critical
CVE-2026-55447
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
High
ghsa-p5wc-9w9r-m232
Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser
Medium
CVE-2026-67338
JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol
Critical
CVE-2026-57125
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
High
CVE-2026-57112
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
Low
ghsa-8rfp-98v4-mmr6
Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output
High
CVE-2026-11816
Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filt
High
CVE-2026-5497
vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processin
Unrated
pysec-2026-207
durabletask 1.4.1, 1.4.2, and 1.4.3 contain malicious code distributed via a compromised maintainer account
Critical
CVE-2026-45758
Malicious code in guardrails-ai 0.10.1 (supply chain compromise)
Low
CVE-2026-45426
Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against D
High
CVE-2026-41084
A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances`) evaluated authorization against the `dag_id` resolved from the URL path whil
Critical
CVE-2026-47391
PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
Critical
CVE-2026-47392
PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)
Medium
CVE-2026-47395
PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
Medium
CVE-2026-47390
PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
Medium
CVE-2026-48525
PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS
High
CVE-2026-44660
UltraJSON has a Memory Leak in ujson.dump() on Write Failure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.