High
ghsa-39wr-7q6h-cf68
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 689
Reset filters
High
ghsa-xjw9-38cr-6372
djust: A template binding inherits a context safety grant it never earned (XSS)
High
ghsa-9395-2g46-rj3f
djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)
Medium
CVE-2026-73555
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
Medium
CVE-2026-73557
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
Medium
CVE-2026-84305
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
Medium
CVE-2026-84311
pypdf: Possible long runtimes/large memory usage when extracting XForm objects
Medium
CVE-2026-81723
NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`
High
CVE-2026-55509
WsgiDAV MySQL provider has a blind SQL injection
High
CVE-2026-55520
Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching
High
CVE-2026-54757
Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
Medium
CVE-2026-55618
eml_parser has a URL extraction bypass via HTML entities in URLs
High
CVE-2026-55539
PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete
High
CVE-2026-55526
praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
High
CVE-2026-55538
PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated
Critical
CVE-2026-61539
Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing
High
CVE-2026-72818
NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking
Medium
CVE-2026-75526
django CMS: Stored XSS in edit-mode plugin exception rendering
Critical
CVE-2026-58473
Cognee allows non-superusers to overwrite global LLM configuration
Medium
CVE-2026-87818
GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle
High
CVE-2026-87819
GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing
High
CVE-2026-87817
GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution
Medium
CVE-2026-12259
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. T
Medium
CVE-2026-81727
NLTK: Downloader.download follows hardlinks and overwrites outside-root files
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.