High
CVE-2026-61428
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,330
Reset filters
Medium
CVE-2026-46438
wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry
High
CVE-2026-46434
wger: Trainer Privilege Escalation - Improper Privilege Management
Medium
CVE-2026-46437
wger: API credentials remain valid after logout/password change
Medium
CVE-2026-45161
wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
High
CVE-2026-43976
wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
High
CVE-2026-105801
openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation
Medium
ghsa-4v7v-gqf9-ww2g
Vyper: Call stack corruption when passing complex type containing non-base type members as argument
Medium
ghsa-vg88-3v92-rjx2
Vyper: Return inside for loop more than 1 level deep
Medium
ghsa-j8f7-x8jm-wmm4
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)
Critical
CVE-2026-10561
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
Low
CVE-2026-105752
vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle
Medium
CVE-2026-102598
Werkzeug safe_join() allows Windows special device names
High
CVE-2026-96748
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
Medium
CVE-2026-96747
PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption
Medium
CVE-2026-105758
vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach
Medium
CVE-2026-105760
vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion
Medium
CVE-2026-105754
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
Medium
CVE-2026-105756
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service
Medium
CVE-2026-102991
Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
Medium
CVE-2026-104874
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
Medium
CVE-2026-88029
pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods
Medium
CVE-2026-105755
vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`
Medium
CVE-2026-105757
vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.