Medium
CVE-2026-55163
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,016
Reset filters
Medium
CVE-2026-55165
Lemur: JWT verifier honors attacker-supplied alg, enabling ATO
Medium
CVE-2026-55162
Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF
Medium
CVE-2026-55863
motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution
High
CVE-2026-54134
OctoPrint has possible file exfiltration via query parameters on upload endpoints
Medium
CVE-2026-31978
motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint
Medium
CVE-2026-32315
motionEye's World-Readable Configuration File Exposes Admin Password Hash
Medium
CVE-2026-46611
Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
Medium
CVE-2026-55837
dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
High
CVE-2026-46608
Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
High
CVE-2026-54499
Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders
High
CVE-2026-54528
jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
High
CVE-2026-12530
Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
High
CVE-2026-54695
Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID
High
CVE-2025-26240
pdfkit: Path traversal in from_string
Medium
CVE-2026-54386
marimo contains a reflected cross-site scripting vulnerability in the notebook page
Low
CVE-2026-12566
BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing
High
CVE-2026-54008
Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
High
CVE-2026-54012
Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
High
CVE-2026-54013
Open WebUI: Stored XSS to Account Takeover via Model Profile Images
High
CVE-2026-54017
Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
High
CVE-2026-54018
Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
Medium
CVE-2026-54021
Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter
Medium
CVE-2026-54022
Open WebUI: Any authenticated user can read other users' private notes via Socket.IO
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.