High
CVE-2026-33509
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,353
Reset filters
High
CVE-2026-28788
Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
Medium
CVE-2026-33545
MobSF has SQL Injection in its SQLite Database Viewer Utils
High
CVE-2025-15031
Arbitrary file write via tar traversal in mlflow
High
CVE-2026-33139
PySpector has a Plugin Sandbox Bypass leads to Arbitrary Code Execution
Medium
CVE-2026-32889
Denial of service via non-terminating SYLT frame parsing loop in tinytag
High
CVE-2026-33155
DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT
Medium
CVE-2026-4269
Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit
Medium
CVE-2026-32111
ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle
High
CVE-2025-69196
FastMCP OAuth Proxy token reuse across MCP servers
Medium
CVE-2026-31815
django-unicorn affected by component state manipulation via unvalidated attribute access
Medium
CVE-2026-29787
mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint
High
CVE-2026-33010
mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft
High
CVE-2026-27826
MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers
Low
CVE-2026-25674
Django has a Race Condition vulnerability
Low
CVE-2026-29790
dbt-common's commonprefix() doesn't protect against path traversal
High
CVE-2026-27905
BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction
Medium
CVE-2026-27839
wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup
High
CVE-2026-27622
OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write
Medium
CVE-2026-25138
Rucio WebUI has Username Enumeration via Login Error Message
High
CVE-2026-1669
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
Medium
CVE-2026-26057
Skill-scanner Unsecured Network Binding Vulnerability
High
ghsa-h4g2-xfmw-q2c9
Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset
Medium
ghsa-9mqm-qcwf-5qhg
CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.