Critical
CVE-2026-33309
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 685
Reset filters
High
CVE-2026-26209
cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads
High
CVE-2026-27953
ormar Pydantic Validation Bypass via __pk_only__ and __excluded__ Kwargs Injection in Model Constructor
High
ghsa-2mhw-8qcg-gr96
skia-python vendors vulnerable libfreetype because of pinned cibuildwheel version
Low
CVE-2026-32722
Stored XSS in Memray-generated HTML reports via unescaped command-line metadata
High
CVE-2026-32596
Glances exposes the REST API without authentication
High
CVE-2026-30922
Denial of Service in pyasn1 via Unbounded Recursion
Critical
Exploited in attacks
CVE-2026-33017
Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint
High
CVE-2026-28490
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
Critical
CVE-2026-27962
Authlib JWS JWK Header Injection: Signature Verification Bypass
Medium
ghsa-5cxw-w2xg-2m8h
fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE`
High
CVE-2026-21887
OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature
High
CVE-2026-30928
Glances Exposes Unauthenticated Configuration Secrets
High
CVE-2026-30930
Glances has SQL Injection via Process Names in TimescaleDB Export
Medium
CVE-2026-29780
eml_parser: Path Traversal in Official Example Script Leads to Arbitrary File Write
High
ghsa-qr2g-p6q7-w82m
x402 SDK Security Advisory
High
CVE-2026-29065
changedetection.io has Zip Slip vulnerability in the backup restore functionality
Medium
CVE-2026-29038
changedetection.io has Reflected XSS in its RSS Tag Error Response
High
CVE-2026-30244
Plane is Vulnerable to Unauthenticated Workspace Member Information Disclosure
Critical
CVE-2026-53873
PickleScan's profile.run blocklist mismatch allows exec() bypass
Low
CVE-2026-27167
Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret
Critical
CVE-2026-27614
Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering
Medium
CVE-2026-27645
changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
Critical
CVE-2026-26198
ormar is vulnerable to SQL Injection through aggregate functions min() and max()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.