Medium
CVE-2026-71322
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 246
Reset filters
High
CVE-2026-71491
sqlparse: Quadratic O(n²) DoS in group_comments
Medium
CVE-2026-59894
sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes
High
CVE-2026-68518
Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction
High
CVE-2026-73568
libp2p: yamux connection DoS via oversized data frame
High
CVE-2026-73622
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
High
CVE-2026-67260
Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an
High
CVE-2026-67587
Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself a
Medium
CVE-2026-70489
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
High
CVE-2026-54574
`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive
High
CVE-2026-54654
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field
Medium
CVE-2026-59220
Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config
Low
CVE-2026-59213
Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)
High
CVE-2026-69097
GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
Medium
CVE-2026-59198
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
High
CVE-2026-54547
meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
High
CVE-2026-54234
vLLM has Remote DoS via Invalid Recovered Token Reinjection
High
CVE-2026-54446
NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode
High
CVE-2026-54447
garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store
High
CVE-2026-57122
PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)
Critical
CVE-2026-57127
praisonai: recipe serve auth middleware silently disables itself when no secret is set
High
CVE-2026-56840
PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools
Medium
ghsa-mfr4-mq8w-vmg6
PRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs
Medium
CVE-2026-59203
Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.