Medium
CVE-2026-10224
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,801
Reset filters
Low
CVE-2026-10223
hermes-agent has an Injection issue
High
CVE-2026-69097
GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
High
CVE-2026-67326
GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
Medium
CVE-2026-13346
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.
Medium
ghsa-wchh-9x6h-7f6p
olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193
High
CVE-2026-54609
QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding
Medium
CVE-2026-66053
Apache Thrift Python bindings have a Improper Validation of Certificate with Host Mismatch vulnerabilit
High
CVE-2026-41608
Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability
High
CVE-2026-43871
Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop
High
CVE-2025-71408
NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arb
Low
ghsa-464c-974j-9xm6
AWS CDK CodeBuild S3 Log Encryption Boolean Inversion
Medium
CVE-2026-66004
BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes
Medium
CVE-2026-66007
Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being join
Medium
CVE-2026-45339
Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints
High
CVE-2026-59200
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
High
CVE-2026-59204
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
Medium
CVE-2026-59820
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
Low
CVE-2026-59821
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
High
Exploited in attacks
CVE-2026-59822
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
Low
CVE-2026-59819
LiteLLM: Local file read via request-supplied OIDC file references
High
CVE-2026-54058
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
Medium
CVE-2026-59198
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
Medium
CVE-2026-54559
PocketSphinx: Buffer overflows in language and acoustic model loading code
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.