Medium
CVE-2026-93421
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 427
Reset filters
Critical
CVE-2026-91130
Home Assistant: XSS in Statistics Graph Card
Medium
CVE-2026-85709
lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses
High
CVE-2026-85740
lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
Medium
CVE-2026-83801
Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text
High
CVE-2026-77274
MCP Atlassian: SSRF Protection Bypass
High
CVE-2026-77260
MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)
High
CVE-2026-77262
MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)
Medium
CVE-2026-77272
MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler
Medium
CVE-2026-86000
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns
Medium
CVE-2026-85999
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)
Medium
CVE-2026-85078
sanic chunked trailer request smuggling allows hidden second request execution
Critical
CVE-2026-61594
djust has an authorization bypass on the WebSocket/SSE mount path
Medium
CVE-2026-61597
djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags
High
CVE-2025-66336
Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path
Low
CVE-2026-12797
BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints
High
CVE-2026-102925
virtualenv bash and fish activation scripts execute commands embedded in paths
Medium
CVE-2026-102938
virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
High
CVE-2026-103262
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
Medium
CVE-2026-81930
Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}.sno
Medium
CVE-2026-81914
Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that del
High
CVE-2026-100844
MONAI vulnerable to OS command injection
Critical
CVE-2026-61732
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Medium
CVE-2026-84380
HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.