Medium
CVE-2026-47411
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,336
Reset filters
High
CVE-2026-47412
praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}
High
CVE-2026-47418
praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR
High
CVE-2026-47417
praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR
High
CVE-2026-47397
PraisonAI has an Arbitrary File Write in Python API
High
CVE-2026-47409
praisonai-platform: Missing authorization on member removal enables full workspace takeover by any user regardless of role
High
CVE-2026-47405
PraisonAI Platform: Missing role checks let any workspace member become owner and control workspace membership
High
CVE-2026-48169
PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API
Medium
CVE-2026-47408
praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership
High
CVE-2026-47399
PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID
High
CVE-2026-47414
praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)
High
CVE-2026-47406
praisonai-platform: IDOR in dependency endpoints allows cross-workspace issue linking, reading, and deletion due to missing ownership checks
High
CVE-2026-47394
PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate
Medium
CVE-2026-47213
BoxLite has a Timeout Bypass Vulnerability
Medium
CVE-2026-47184
zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood
Medium
CVE-2026-46380
compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem
Medium
CVE-2026-45774
compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal
High
CVE-2026-10105
agno contains a SQL injection vulnerability
High
CVE-2026-48544
Taipy contains a path traversal vulnerability
High
CVE-2026-45725
compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal
Medium
CVE-2026-45309
AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username
Medium
CVE-2026-46715
Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance
Low
CVE-2026-46497
Crawlee for Python: SSRF via sitemap-derived URLs
Medium
CVE-2026-46561
pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.