Medium
CVE-2026-40610
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,343
Reset filters
High
CVE-2026-42557
JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content
High
CVE-2026-42561
python-multipart has Denial of Service via unbounded multipart part headers
High
CVE-2026-44307
Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup
Low
CVE-2026-42448
Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed
High
CVE-2026-42544
Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panic
Medium
CVE-2026-42545
Granian vulnerable to DoS via WSGI response header panic
Medium
CVE-2026-44226
PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI
Medium
CVE-2026-44222
vLLM Vulnerable to Remote DoS via Special-Token Placeholders
Low
CVE-2026-44220
ciguard: discover_pipeline_files follows symlinks out of scan root
High
CVE-2026-33079
Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input
Medium
CVE-2026-42303
Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection
Medium
CVE-2026-43901
wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured
Medium
CVE-2026-42078
PPTAgent: Arbitrary File Write + Directory Creation via markdown_table_to_image
Medium
CVE-2026-42080
PPTAgent: Arbitrary File Write via `save_generated_slides`
High
CVE-2025-67796
IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users
High
CVE-2026-42301
pyp2spec is Vulnerable to Code Injection
Medium
CVE-2026-6357
pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
Low
CVE-2026-41140
Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4
High
CVE-2026-33626
LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
Medium
CVE-2026-3219
pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files
High
CVE-2026-41490
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
Medium
CVE-2026-40347
python-multipart affected by Denial of Service via large multipart preamble or epilogue data
Medium
CVE-2026-40159
PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.