High
CVE-2026-61442
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,984
Reset filters
High
CVE-2026-61427
PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface
Medium
CVE-2026-61440
PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization
High
CVE-2026-60091
PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
High
CVE-2026-61433
PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
High
CVE-2026-61435
PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
High
CVE-2026-107377
datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory
Medium
CVE-2026-60088
PraisonAI: Project custom command templates can read outside-workspace files into model prompts
Medium
CVE-2026-60090
PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL
Medium
CVE-2026-107292
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
High
CVE-2026-107295
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
Medium
CVE-2026-107290
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
High
CVE-2026-61430
PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure
Medium
CVE-2026-60089
PraisonAI: Project config can auto-save agent output outside the project root
Critical
CVE-2026-105697
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
Medium
CVE-2026-105698
Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
High
CVE-2026-105699
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
High
CVE-2026-106439
Hydra: Mutable instantiate policy sets allow target blocklist bypass
High
CVE-2026-106443
WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE
High
CVE-2026-106441
Hydra logging configuration permits unsafe callable resolution
High
CVE-2026-106442
Hydra instantiate target blacklist bypasses permit code execution
Medium
CVE-2026-106454
Twisted: IMAP wildcardToRegexp() ReDoS
High
CVE-2026-105741
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
Critical
CVE-2026-61444
PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.