High
CVE-2026-56695
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,334
Reset filters
High
CVE-2026-67322
GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
High
CVE-2026-62240
crewai-tools SSRF redirect bypass exposes internal services
High
CVE-2026-67325
GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
High
CVE-2026-67323
GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`
Critical
CVE-2026-58473
Cognee allows non-superusers to overwrite global LLM configuration
High
CVE-2026-49114
ONNX: TOCTOU arbitrary file read/write in save_external_dat
High
CVE-2026-9769
Uncontrolled recursion DoS in JustHTML() via deeply nested HTML
Medium
CVE-2026-87818
GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle
High
CVE-2026-87819
GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing
High
CVE-2026-87817
GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution
High
CVE-2026-84381
HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies
Medium
CVE-2026-73262
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
High
pysec-2026-4010
Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit
Critical
pysec-2026-4009
Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator
Critical
CVE-2024-33663
python-jose algorithm confusion guard bypassed by DER-encoded public keys
Medium
CVE-2026-91990
tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
Low
CVE-2026-91991
Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`
High
ghsa-gqvg-gmmx-x4hm
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
Medium
ghsa-73p9-6hrp-8qhr
AIIR verification and policy gates could report success without enforcing the control (fail-open)
Medium
CVE-2026-81725
NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks
Medium
CVE-2026-81727
NLTK: Downloader.download follows hardlinks and overwrites outside-root files
Medium
CVE-2026-81724
NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input
High
CVE-2026-81726
NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.