Medium
CVE-2026-45161
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 440
Reset filters
High
CVE-2026-43976
wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
Critical
CVE-2026-10561
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
High
CVE-2026-96748
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
Medium
CVE-2026-88029
pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods
Critical
CVE-2026-9205
Langflow: Weak Fernet Key via random.seed()
Critical
CVE-2026-114107
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
High
CVE-2026-97687
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
High
CVE-2026-102273
PyJWT accepts public JWK containers as HMAC secrets
High
CVE-2026-102271
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
High
CVE-2026-57443
SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
High
CVE-2026-57170
Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
Critical
CVE-2026-57149
plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection
Medium
CVE-2026-93421
Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
Critical
CVE-2026-91130
Home Assistant: XSS in Statistics Graph Card
Medium
CVE-2026-85709
lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses
High
CVE-2026-85740
lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
Medium
CVE-2026-83801
Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text
High
CVE-2026-77274
MCP Atlassian: SSRF Protection Bypass
High
CVE-2026-77260
MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)
High
CVE-2026-77262
MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)
Medium
CVE-2026-77272
MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler
Medium
CVE-2026-86000
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns
Medium
CVE-2026-85999
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.