Unrated
CVE-2026-81684
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,334
Reset filters
Medium
CVE-2026-79720
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote
Medium
CVE-2026-79719
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote
Medium
CVE-2026-79718
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote
Medium
ghsa-x287-5c68-36wp
OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses
Critical
ghsa-93qj-5q5v-3c2h
Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)
High
CVE-2026-80206
NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
High
CVE-2026-80205
NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions
Medium
CVE-2026-65087
NVIDIA NemoClaw contains a vulnerability where an attacker could cause
Medium
CVE-2026-54338
JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
High
ghsa-vwf3-4xxj-qg6h
mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment
Critical
CVE-2026-79675
NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)
High
CVE-2026-79676
NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement
High
CVE-2026-79674
NLTK: Corpus Reader Sandbox Bypass
High
ghsa-8cp3-qxj6-px34
utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion
Medium
CVE-2026-12210
utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins
High
ghsa-9qhg-99ww-9mqc
utcp-http SSRF: HTTP tool invocation follows redirects without re-validating the target
High
CVE-2026-55522
PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code
Critical
CVE-2026-79657
NLTK: Allowlisted pickle loaders still permit code execution in current source
Unrated
CVE-2026-78684
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to ini
Critical
CVE-2026-78683
NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution
Critical
CVE-2026-78676
GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE
High
CVE-2026-78677
GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
Medium
CVE-2026-78678
GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.