High
CVE-2026-59205
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 246
Reset filters
Medium
ghsa-8f6j-263m-g72x
Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks
Medium
CVE-2026-49836
psd-tools vulnerable to arbitrary file write via smart-object filename
High
CVE-2026-49471
Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE
High
CVE-2025-46719
Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions
Medium
CVE-2026-54724
Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint
High
CVE-2026-50180
Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read
Medium
CVE-2026-55165
Lemur: JWT verifier honors attacker-supplied alg, enabling ATO
High
CVE-2026-53925
Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
Medium
CVE-2026-48487
zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet
Medium
CVE-2026-55206
py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()
Medium
CVE-2026-46611
Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
High
CVE-2026-46607
Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution
High
CVE-2026-46606
Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py
High
CVE-2026-50023
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
High
CVE-2026-50574
yt-dlp: Arbitrary code execution via manifest downloads with aria2c
High
CVE-2026-53539
python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service
Low
CVE-2026-53538
python-multipart: Semicolon treated as querystring field separator enables parameter smuggling
High
CVE-2026-48060
Litestar has HTML Injection Through its CSRF Token
High
CVE-2026-47394
PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate
High
CVE-2026-46439
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
High
CVE-2026-42305
Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
High
CVE-2026-45725
compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal
Medium
CVE-2026-8597
Amazon SageMaker Python SDK is missing integrity verification in its Triton inference handler
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.