Medium
CVE-2026-96747
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 246
Reset filters
Medium
CVE-2026-105758
vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach
Medium
CVE-2026-105756
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service
Medium
CVE-2026-104874
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
High
CVE-2026-114094
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
High
CVE-2026-114096
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
High
CVE-2026-114098
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
Medium
CVE-2026-97688
urllib3: Chunked Deflate streaming can enter an infinite loop
Medium
CVE-2026-101918
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
Medium
CVE-2026-101917
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
Medium
CVE-2026-102270
PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
High
CVE-2026-102271
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
Medium
CVE-2026-61541
Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service
High
CVE-2026-77271
MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)
High
CVE-2026-77243
MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
Medium
CVE-2026-85078
sanic chunked trailer request smuggling allows hidden second request execution
Medium
CVE-2026-59823
LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
Medium
CVE-2026-87014
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
Medium
CVE-2026-88006
Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
Medium
CVE-2026-87012
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
Medium
CVE-2026-87013
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
High
CVE-2026-87998
Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
Medium
CVE-2026-88005
Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange
Medium
CVE-2026-102904
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.