High
CVE-2026-96749
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,801
Reset filters
High
CVE-2026-96748
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
Medium
CVE-2026-96747
PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption
Medium
CVE-2026-105758
vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach
Medium
CVE-2026-105760
vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion
Medium
CVE-2026-105754
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
Medium
CVE-2026-105756
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service
Medium
CVE-2026-104843
uv: Path traversal on Windows through wheel extraction
Medium
CVE-2026-102991
Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
Medium
CVE-2026-104874
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
Medium
CVE-2026-88029
pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods
Medium
CVE-2026-105755
vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`
Medium
CVE-2026-105757
vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)
Medium
CVE-2026-105753
vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core
Medium
CVE-2026-86597
Snowflake drivers writes sensitive information to logs
High
CVE-2026-104851
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
High
ghsa-v853-p72q-4cfw
Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__
High
CVE-2026-104873
LangGraph SDK custom auth silently ignores actions= on resource decorators
Medium
CVE-2026-105751
Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
Critical
CVE-2026-9205
Langflow: Weak Fernet Key via random.seed()
Critical
CVE-2026-8505
Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass
High
CVE-2026-51886
Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description
High
CVE-2026-7700
Langflow: Prompt injection in Langflow Smart Transform can lead to code execution
Medium
CVE-2026-105750
Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.