Critical
CVE-2026-45568
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,016
Reset filters
Critical
CVE-2026-7302
SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability
High
CVE-2026-2652
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and
High
CVE-2026-56398
Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
Medium
ghsa-g39v-cvjh-8fpf
Home Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/
Medium
CVE-2026-44439
Playwright Capture permits access to local files and internal network resources during page capture
High
CVE-2026-42304
Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
High
CVE-2026-42266
JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
Medium
CVE-2026-86255
wger has an Uncontrolled Resource Consumption issue
High
CVE-2026-45134
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
Medium
CVE-2026-44223
vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters
Critical
CVE-2026-31238
Ludwig framework is vulnerable to insecure deserialization in its model serving component
Critical
CVE-2026-31234
Horovod contains an insecure deserialization vulnerability in its KVStore HTTP server component
Critical
CVE-2026-31220
PySyft server-side arbitrary Python execution after code approval
Critical
CVE-2025-65719
Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page
High
CVE-2026-43891
changedetection.io has an Arbitrary Local File Read via a crafted backup restore
High
CVE-2026-2614
MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem
High
CVE-2026-2393
A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/server/handlers.py` accepts a user-controlled `url` parameter w
High
CVE-2026-42860
edx-enterprise has SSRF via SAML metadata URL in sync_provider_data endpoint
High
CVE-2026-42313
pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
Medium
CVE-2026-42312
pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
Medium
ghsa-88q9-cmp2-c2vq
oxidize-pdf: NaN/inf bypass in colour content-stream emission causes PDF rejection (DoS)
Critical
CVE-2026-44336
PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection
Medium
CVE-2026-43826
The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedd
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.