Medium
CVE-2026-73559
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 116
Reset filters
High
CVE-2026-55071
MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`
High
CVE-2026-52776
compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
Medium
CVE-2026-74875
openssl-encrypt silently skips schema validation when jsonschema library is not installed
High
CVE-2026-55415
datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements
High
CVE-2026-54655
`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator
High
CVE-2026-54656
`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data
Medium
CVE-2026-59212
Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
Critical
CVE-2026-57496
netlicensing-mcp: REST Path Traversal Bypasses Token Redaction
Medium
CVE-2026-57120
PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder
High
CVE-2026-57119
PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API
High
CVE-2026-57114
PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
Critical
CVE-2026-57131
PraisonAI: Jobs API exposes agent-execution endpoints with no authentication
Critical
CVE-2026-54760
Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls
Critical
CVE-2026-55615
Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879
High
CVE-2026-50180
Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read
High
CVE-2026-52726
Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload
High
CVE-2026-54012
Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
High
CVE-2026-54013
Open WebUI: Stored XSS to Account Takeover via Model Profile Images
Low
CVE-2026-53537
python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters
Low
CVE-2026-53538
python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
Medium
CVE-2026-48053
Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset
Medium
CVE-2026-46526
local-deep-research has an SSRF bypass in `safe_get`
High
CVE-2026-42305
Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.