Critical
CVE-2025-62373
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,336
Reset filters
High
CVE-2026-41205
Mako: Path traversal via double-slash URI prefix in TemplateLookup
Critical
CVE-2026-3960
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient secu
Medium
CVE-2026-40594
pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)
High
CVE-2026-35587
Glances has SSRF in IP Plugin via public_api leading to credential leakage
High
CVE-2026-34839
Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS
Medium
CVE-2026-28684
python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback
Medium
CVE-2026-40491
gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall
Medium
CVE-2026-40256
Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision
Low
CVE-2026-7808
Multiple security fixes in justhtml
Critical
CVE-2026-40576
excel-mcp-server has a Path Traversal issue
Critical
CVE-2026-40258
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
Medium
CVE-2026-39921
GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outboun
Medium
CVE-2026-39922
GeoNode contains a server-side request forgery vulnerability in the service registration endpoint
Medium
ghsa-vj8v-p5vw-m6v5
xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern
Low
CVE-2026-114110
uv vulnerable to arbitrary file deletion through RECORD entries
Critical
CVE-2026-40289
PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions
High
CVE-2026-40287
PraisonAI Vulnerable to RCE via Automatic tools.py Import
Medium
CVE-2026-56074
PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands
High
ghsa-x462-jjpc-q4q4
PraisonAI: Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint
Critical
CVE-2026-40157
PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`
High
CVE-2026-56075
PraisonAI: Hardcoded `approval_mode="auto"` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command Execution
Critical
CVE-2026-40111
PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)
Medium
CVE-2026-5388
justhtml includes multiple security fixes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.