Medium
CVE-2026-97688
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,999
Reset filters
High
CVE-2026-97689
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
Medium
CVE-2026-84377
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
High
CVE-2026-97687
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
Medium
CVE-2026-102269
PyJWT: Non-canonical signature segments enable raw-token revocation bypass
Critical
CVE-2026-102268
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
High
CVE-2026-102272
PyJWT BOM Bypass
Medium
CVE-2026-102265
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
Medium
CVE-2026-101917
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
High
CVE-2026-102266
PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
High
CVE-2026-102267
PyJWT: PyJWKClient follows redirects when fetching JWKS
Medium
CVE-2026-102270
PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
High
CVE-2026-57443
SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
Medium
CVE-2026-49264
Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
High
CVE-2026-57171
Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
Medium
CVE-2026-59980
hpack: Unbounded variable integer decoding can cause run-away computation on malformed input
High
CVE-2026-57170
Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
Medium
CVE-2026-61541
Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service
Medium
CVE-2026-92164
Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files
Critical
CVE-2026-57149
plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection
Medium
CVE-2026-93421
Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
High
CVE-2026-61652
Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)
Medium
CVE-2026-83805
Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs
Medium
CVE-2026-91129
Home Assistant: mDNS Server-Side Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.