High
CVE-2026-54549
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,801
Reset filters
High
CVE-2026-54547
meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
High
CVE-2026-54567
Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)
Critical
CVE-2026-61740
LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
Critical
CVE-2026-61736
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
High
CVE-2026-54234
vLLM has Remote DoS via Invalid Recovered Token Reinjection
High
CVE-2026-54552
sh _uid does not drop supplementary groups (incomplete privilege drop)
Medium
CVE-2026-54503
plone.app.textfield: Stored XSS by spoofing mime type
High
CVE-2026-59950
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
High
CVE-2026-52870
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
High
CVE-2026-52869
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
High
CVE-2026-50271
dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
High
CVE-2026-54457
TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint
High
CVE-2026-54446
NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode
High
CVE-2026-54449
LangBot: Authenticated RCE Via MCP Configuration
High
CVE-2026-54447
garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store
Medium
CVE-2026-53656
FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
High
CVE-2026-61668
DIRAC: Pilot code downloaded over unverified HTTPS connection
Medium
CVE-2026-54254
Pixeldrain API key shared with unverified thirdparty sites
High
CVE-2026-57132
PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication
Critical
CVE-2026-57147
praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery
High
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
Critical
CVE-2026-57496
netlicensing-mcp: REST Path Traversal Bypasses Token Redaction
Critical
CVE-2026-45579
DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.