High
ghsa-889w-m37p-88m5
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 430
Reset filters
High
CVE-2026-61442
PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass
High
CVE-2026-61434
PraisonAI: Shell command allowlist bypass via find -exec built-in action
Medium
CVE-2026-61440
PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization
High
CVE-2026-61433
PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
Medium
CVE-2026-60088
PraisonAI: Project custom command templates can read outside-workspace files into model prompts
Medium
CVE-2026-60090
PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL
Medium
CVE-2026-107290
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
Critical
CVE-2026-105697
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
High
CVE-2026-106443
WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE
Critical
CVE-2026-61444
PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
Medium
CVE-2026-61441
PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
High
CVE-2026-61436
PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
High
CVE-2026-46434
wger: Trainer Privilege Escalation - Improper Privilege Management
Medium
CVE-2026-45161
wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
High
CVE-2026-43976
wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
Critical
CVE-2026-10561
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
High
CVE-2026-96748
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
Medium
CVE-2026-88029
pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods
Critical
CVE-2026-9205
Langflow: Weak Fernet Key via random.seed()
Critical
CVE-2026-114107
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
High
CVE-2026-97687
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
High
CVE-2026-102273
PyJWT accepts public JWK containers as HMAC secrets
High
CVE-2026-102271
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.