Medium
CVE-2026-37737
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,817
Reset filters
Medium
CVE-2026-57128
PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint
High
CVE-2026-56832
PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
Low
CVE-2026-11312
bytedance InfiniStore: Denial of Service via Non-Cryptographic Hashing in InfiniStore KV Map
High
CVE-2026-11332
ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution
High
CVE-2026-44393
OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake
Low
CVE-2026-50266
OpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device owners on shared networks
Low
CVE-2026-10801
ms-swift: Image Cache Hash Collision via Missing Dimension Metadata
Critical
CVE-2026-41283
OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed
Medium
CVE-2026-48681
OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image
Low
CVE-2026-10813
LMCache: 16-bit multimodal hash collision can poison KV cache entries
Low
CVE-2026-10812
GPTCache: File and image cache keys collide because BufferedReader.peek() only reads the buffered prefix
Low
CVE-2026-10766
mlrun: DataFrame hash collisions can cause dataset artifact path conflicts and silent data corruption
Medium
CVE-2026-46447
OpenStack Ironic allows Boot Script Injection
Medium
CVE-2026-73627
JupyterLab PluginManager lock-rule enforcement bypass
Low
CVE-2026-73626
JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)
Medium
CVE-2026-47143
Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds
High
CVE-2026-67324
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes atta
Unrated
CVE-2023-54366
SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database ac
Medium
ghsa-mfr4-mq8w-vmg6
PRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs
High
CVE-2026-53598
Prompty: Arbitrary file read via file reference expansion
Medium
ghsa-8rqh-vxpr-x77p
plone.restapi: Stored XSS by spoofing mime type
Critical
CVE-2025-65720
GPT Researcher MCP STDIO configuration allows remote command execution
High
CVE-2026-105315
django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result Deserialization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.