High
CVE-2026-102831
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 693
Reset filters
Unrated
CVE-2026-100841
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MON
Critical
CVE-2026-61732
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
Medium
CVE-2026-77528
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
High
ghsa-39wr-7q6h-cf68
LMDeploy has an SSRF bypass
High
ghsa-xjw9-38cr-6372
djust: A template binding inherits a context safety grant it never earned (XSS)
High
ghsa-9395-2g46-rj3f
djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)
Medium
CVE-2026-73555
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
Medium
CVE-2026-73557
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
Medium
CVE-2026-84305
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
Medium
CVE-2026-84311
pypdf: Possible long runtimes/large memory usage when extracting XForm objects
Medium
CVE-2026-81723
NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`
High
CVE-2026-55509
WsgiDAV MySQL provider has a blind SQL injection
High
CVE-2026-55520
Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching
High
CVE-2026-54757
Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
Medium
CVE-2026-55618
eml_parser has a URL extraction bypass via HTML entities in URLs
High
CVE-2026-55539
PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete
High
CVE-2026-55526
praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
High
CVE-2026-55538
PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated
Critical
CVE-2026-61539
Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing
High
CVE-2026-72818
NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking
Medium
CVE-2026-75526
django CMS: Stored XSS in edit-mode plugin exception rendering
Critical
CVE-2026-58473
Cognee allows non-superusers to overwrite global LLM configuration
Medium
CVE-2026-87818
GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.