High
CVE-2026-45402
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 246
Reset filters
High
CVE-2026-45348
pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal
High
CVE-2026-45350
Open WebUI's chat completion API allows tool restrictions to be bypassed
Medium
CVE-2026-44337
PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries
Medium
CVE-2026-44550
Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts
High
CVE-2026-44334
PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)
High
CVE-2026-40474
wger has Broken Access Control in Global Gym Configuration Update Endpoint
Medium
CVE-2026-40347
python-multipart affected by Denial of Service via large multipart preamble or epilogue data
High
CVE-2026-34588
OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
Medium
CVE-2025-64183
OpenEXR has use after free in PyObject_StealAttrString
High
CVE-2026-40072
web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling
Medium
CVE-2026-28786
Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`
High
CVE-2026-73496
mcp-atlassian: Arbitrary server-side file read via attachment upload
Medium
ghsa-9mqm-qcwf-5qhg
CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources
Medium
CVE-2026-59927
Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
Medium
ghsa-f66q-9rf6-8795
Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion
Medium
ghsa-q855-8rh5-jfgq
ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path
High
CVE-2026-23490
pyasn1 has a DoS vulnerability in decoder
High
CVE-2026-24049
Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack
High
CVE-2026-22871
GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
High
CVE-2026-22033
Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field
Medium
CVE-2026-22701
filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock
High
CVE-2026-23949
jaraco.context Has a Path Traversal Vulnerability
High
CVE-2026-21873
NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.